This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The FunkSec ransomware group, an emerging threat actor, has utilized AI tools, specifically Miniapps chatbots, to facilitate the rapid development and refinement of custom ransomware and other malicious tools. Despite the group's members appearing to be inexperienced, the use of AI has allowed them to iterate their malware quickly and conduct double-extortion campaigns against over 80 victims globally. The group's activities blur the lines between hacktivism and cybercrime, with researchers noting that many of their claims and leaked datasets may be recycled or unverified.
The FunkSec ransomware group allegedly leveraged AI tools, such as Miniapps chatbots, to develop and refine its ransomware operations, which is reported to have allowed apparently inexperienced actors to produce advanced malware rapidly. It is reported that the group claimed to have launched its data leak site in December 2024, allegedly targeting over 80 victims with ransomware and double extortion tactics. AI reportedly supported the creation of detailed code comments in order to refine the group's technical presentation, while also allegedly facilitating the rapid iteration of its custom encryptor written in Rust.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The group generated and published a fake, AI-generated audio recording of a call between political figures to boost their credibility.
The group uses AI-assisted ransomware for double extortion, blackmailing victims, and selling stolen data for financial gain.
The incident involves the use of AI systems to assist in coding and developing cheaper, more rapidly iterating ransomware and custom malware tools.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The security risk was caused by human threat actors who intentionally used deployed AI models and platforms to develop malware and support cyberattacks.
Added categories peak at 2: Minor (Epistemic Harm, Direct)
The FunkSec ransomware group utilized AI tools to lower the technical barrier for malware development, enabling inexperienced actors to conduct rapid double-extortion campaigns against over 80 global victims. While the national security impact remains minor, it demonstrates how AI-assisted coding accelerates the proliferation of cyber threats.
The AI system acted as an assistant to the human developers, helping them write code comments, refine Rust code, and build a supporting chatbot, thereby augmenting their capabilities rather than acting autonomously.
Limited Risk: The incident involves the deployment of an AI chatbot and the generation of deepfake audio content, both of which fall under transparency obligations for limited risk systems under the EU AI Act.
The primary use of AI by the group was to assist in writing and refining the ransomware code and comments. They also deployed a chatbot to support their operations.
The reports from Check Point Research provide highly detailed cybersecurity analyses of the group's operations, tools, and AI usage. The technical details regarding the Rust binary and the Miniapps chatbot are clear, though some victim details remain unconfirmed by the victims themselves.
The AI's role could be viewed purely as a general-purpose coding tool rather than a specialized malicious AI, but the release of a custom malicious chatbot supports the AI-assisted threat classification.
Technology
AI-Assisted Malware Generation
LLMs enabled rapid writing and refinement of Rust-based ransomware.
Unrestricted AI Platforms
Miniapps allowed creation of malicious chatbot without standard safety guards.
AI Audio Generation Tools
Used to create fake audio leaks of politicians to boost group credibility.
Data Inputs
Malicious Source Code Inputs
Developer fed ransomware source code into LLMs to automate improvements.
Human Factors
Low Technical Skill of Actors
Inexperienced developers used AI to bypass their lack of programming skills.
Language Barrier Compensation
LLMs generated perfect English comments, masking the author's basic skills.
Process and Methods
AI-Driven Rapid Code Iteration
Using AI agents to quickly generate and test new ransomware versions.
Malicious Chatbot Support
Deploying a custom AI bot to automate and support cybercrime operations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
