Hackers used Claude to plan a ransomware attack, but accidentally exposed the inner workings of their own operation

SOCRadar's threat research unit found that ransomware operators used OpenCode to call models such as Claude Opus 4.6 and Kimi K3, using AI across 133 sessions and 8,257 messages to plan reconnaissance, generate commands and draft ransomware materials, while human operators retained approval. The exposed server also led to six other hosts, and logs linked the activity to the INC Ransomware and The Gentlemen affiliates; the operators claimed to have exploited vulnerabilities such as CVE-2024-57727.