Researchers at SOCRadar have turned up a rare look inside how criminals work. An open server tied to affiliates of the INC and The Gentlemen ransomware operations held 8,257 AI messages with Claude and Kimi, 46 encryptor builds and 62 named victims. The find is a concrete example of ransomware gangs using AI assistants as part of their daily routine, and it offers useful lessons for individuals and small businesses.
The source report is brief, so this article sticks to what has been published and avoids guessing about details that have not been made public.
What SOCRadar Found on the Open Server
According to the summary of SOCRadar's findings, the server was left openly accessible and was linked to affiliates of two ransomware groups, INC and The Gentlemen. Three numbers define the discovery:
- 8,257 AI messages exchanged with the assistants Claude and Kimi
- 46 encryptor builds, meaning compiled versions of the file-locking malware that are ready to deploy
- 62 named victims, organizations identified on the server
An exposed server of this kind works like a workshop with the door left open. Instead of seeing only the finished attack, researchers can see tools, records and the working conversations behind them. Operational mistakes by criminals, such as leaving infrastructure unsecured, are one of the few ways defenders get this kind of visibility.
How INC and The Gentlemen Used Claude and Kimi
The headline detail is the volume of AI conversations. More than eight thousand messages suggest the assistants were not an occasional experiment but a regular part of the workflow for these affiliates. The source material confirms the presence of the chats alongside the encryptor builds and victim records. It does not, in the information available here, spell out every task the assistants were used for, so we will not speculate about specific prompts or outputs.
What the combination does show is that AI chat tools sit next to the machinery of an attack campaign: malware builds on one side, a victim list on the other, and a long record of AI conversations in between. For defenders, the practical takeaway is that AI can speed up routine work for criminals, which may lower the effort needed to prepare and run attacks.
It also matters that two different assistants appear. Claude and Kimi come from different developers, which suggests affiliates are not tied to a single tool and may switch between them.
What the 62 Named Victims Suggest About Targeting
Sixty-two named victims alongside 46 encryptor builds points to an organized, repeatable operation rather than a one-off intrusion. Having many builds ready suggests attackers prepare tailored or varied versions of their malware in advance, which can make simple signature-based detection less reliable.
The source does not break down which industries or regions the victims belong to, so it would be wrong to draw firm conclusions about sector targeting. A reasonable reading is narrower: ransomware affiliates keep working lists of targets and prepare tooling ahead of time. That pattern is consistent with the wider trend of crews hitting organizations that are easier to pressure, a theme explored in our look at how Qilin and Akira ransomware gangs are escalating supply chain hits.
What This Means For You
If you run a small business or manage your own devices, the news can feel distant, but the lesson is practical. AI assistance does not invent new ways to break in so much as make existing methods faster to prepare. That means the basics matter more, not less.
- Individuals: Attackers still depend on stolen passwords, unpatched software and tricked users. Strong, unique logins and updated devices remain effective barriers.
- Small businesses: Being small is not protection. Affiliates keep victim lists, and preparation is cheap when tooling is already built.
- Everyone: Do not assume you can spot an attack by sloppy wording or clumsy technique. AI can help polish both.
How to Reduce Your Ransomware Risk With Backups, Patching and MFA
Three habits do most of the work against ransomware, whoever or whatever helps the attacker:
- Keep offline or immutable backups. Ransomware is designed to lock your files, and a backup that attackers cannot reach turns a crisis into an inconvenience. Test restores regularly, because an untested backup is a guess.
- Patch promptly. Install updates for operating systems, browsers, VPN appliances and remote access tools as soon as you can. Prioritize anything exposed to the internet.
- Turn on multi-factor authentication (MFA). Enable it on email, remote access, admin accounts and cloud services. Stolen passwords alone then become far less useful.
Add a few supporting steps: limit administrator rights, segment important systems from everyday ones, and write down who to call if you are hit.
The Bottom Line
SOCRadar's discovery is a reminder that ransomware gangs using AI assistants are already operating at a scale measured in thousands of messages, dozens of malware builds and dozens of victims. You cannot control what criminals do with these tools, but you can control how prepared you are. Set up offline backups, patch quickly and enable MFA this week. To understand the broader pressure on organizations, read our piece on how ransomware gangs like Qilin and Akira are targeting supply chains.
