Opportunistic Data Theft and Ransom: GTG-50014 Case

What happened

Some cyber threat actors conduct targeted intrusions to find specific information for espionage or other purposes; others are less focused and deliberate in their operations. These opportunistic hackers have historically used broad scanning techniques to identify and probe unpatched internet-facing systems, then exploit those vulnerabilities to break into or take over target systems. We identified multiple advanced threat actors who used AI to enhance their opportunistic criminal activity, leveraging Claude's capabilities to accelerate their ability to rapidly scan, exploit, and take over target systems.

Opportunistic attacks take many forms: mass exploitation ahead of N-day patches; rummaging through public container stores, code repositories, mobile apps, websites, and more for credentials, tokens, and API keys; mass scanning and exploiting vulnerable internet-facing devices; creating service accounts on poorly secured novice service providers to escape their containers; prompt injection against LiteLLM or OpenClaw deployments; and more.

Many actors search the internet for ways into networks and services, steal data to sell and ransom, then resell access. This was true before AI. However, with AI, the pre-existing ecosystem of cybercriminal network behavior has increased in both scale and severity. With AI, diverse target environments become understandable and adaptable; unique and obscure configurations become clear and exploitable. The old adage of "security through obscurity" is no longer viable in this AI-assisted new world: anything connected to the internet is a potential exploitation target.

Once actors gain access, they typically go straight for databases looking for customer data. If the target is a software-as-a-service (SaaS) provider, they often use the stolen data to access end customers and issue ransom demands, telling the provider that if they don't pay, all their data and customer data will be leaked or sold online.

We identified and disrupted multiple financially motivated cybercriminal activity clusters carried out by operators suspected of being affiliated members of the ShinyHunters collective, which is known for issuing "pay or leak" ransom demands after multiple large-scale data theft operations. Although these affiliated members appeared diverse and seemed to run with their own tools and operational workflows, analysis of their methods and targets showed they belonged to the same overall operation.

What the AI did

A French-speaking operator using aliases (MeowSHA | frkoo | blazespider) ran a distributed credential collection pipeline on 10 AWS EC2 worker machines. The pipeline bulk-downloaded 1.8 million distinct Android APKs from multiple app store sources, decompiled them, and scanned for hardcoded secrets using TruffleHog. Validated findings were routed in real time to a Telegram group organized by over 100 source types. A parallel GitHub organization email collector provided a second stream of stolen GitHub personal access tokens. These two credential pipelines provided the initial access credentials for most confirmed intrusions linked to frkoo.

The operator's operational security discipline was uneven. frkoo managed an EC2-based credential collection pipeline that exposed its own EC2 staging IPs, multiple Telegram bot tokens, a Squid proxy with hardcoded credentials, and at least one direct upload to a public paste site within a victim's environment. They also registered a domain impersonating the French National Police, policenationale[.]cc (although we believe this was used as branding for a criminal storefront rather than a phishing lure). The subdomain autoshop.policenationale[.]cc served as the web front end for this actor's carding auto-shop: a storefront selling stolen payment card records ("fiches") enriched with BIN lookups, full cardholder PII, and an interactive geolocation map of victim addresses. The shop was delivered to customers via a Telegram mini-app (@Soraki_Bot) powered by the actor's "Soraki" platform, a PostgreSQL/GraphQL stack that also aggregated multiple French data breach datasets (including a telecom/ISP dataset of about 400,000 records with IBAN and BIC) into a searchable service.

Across the operator collective, during multiple target intrusions, the target's AI API keys were stolen from the target's enterprise software vendors. One of the stolen API keys was then used by the attacker for about three weeks to carry out secondary attacks, including intruding into a French retail chain and probing a Web3 identity platform. They also continued post-breach attacks against a non-profit victim, and in frkoo's case, continued developing their carding shop disguised as a French police website.

One of the more serious intrusions targeted a technology provider. The actor exfiltrated over 1 TB of data, including hundreds of thousands of national ID numbers and millions of payment card records, then staged the stolen material on a public website to pressure the victim into paying a ransom. At an airline, the threat actor accessed the system storing tens of millions of passenger records. At an energy company, the actor claimed they could remotely control the charging current of electric vehicle chargers installed in customers' homes.

Another affiliated member appeared to specialize in supply chain theft—intruding into a company to obtain downstream data on its customers. After intruding into a software-as-a-service provider, the actor used that foothold to extract data belonging to about 200 downstream customer organizations of the SaaS company. Then, in about 34 hours, a session storage dump was performed containing over 2,100 sets of Azure AD tokens, covering more than 40 enterprise tenants. AI agents did almost all the work.

In another intrusion, the actor used Claude to conduct a supply chain intrusion against a software-as-a-service (SaaS) vendor to accelerate reconnaissance and enable data exfiltration. The actor used a cross-site scripting vulnerability to gain access, escalate privileges, and ultimately exfiltrate data from thousands of downstream customer organizations. The actor used Claude to help identify, understand, and use developer and authentication APIs, create and transform privileged tokens, and build tools to enable bulk export and cross-tenant data collection. Against another target, the same attacker also claimed to have collected $2,000 and $5,000 in legitimate HackerOne bug bounties from two companies they had intruded into and ransomed, treating vulnerability bounty disclosure programs and intrusions as additional revenue streams against the same target. They also appeared to scrape HackerOne and BugBounty submissions as a form of reconnaissance during focused campaigns against specific targets.

The threat actor's operational tempo was relatively steady. One enterprise software company intrusion went from first access to bulk data theft in just hours. Another intrusion escalated from a stolen developer token to full administrative control of the victim's cloud environment in about 3 hours. This was followed by iterative scraping of internal data stores and, in supply chain attack cases, iterative access to and scraping of end customers' data. We detected and banned accounts associated with ShinyHunters affiliated members, implemented measures to detect and disrupt future abuse by the actor, and engaged with government authorities, industry partners, and victims to remediate the threat posed by the actor.

The use of AI in intrusion and data theft operations often resembles "vibe hacking," where the operator instructs the AI to achieve a general goal, such as using a certain entity's credentials or retrieving data from a broad set of targets, then lets the AI assess the environment, write and execute scripts, provide summaries, and iterate until the task is complete. Often, the operator may not directly understand each target environment or the complexity of finding and accessing valuable information, leaving the specifics to the AI.

Security practitioners use the term "living off the land" to describe attacks that use tools already present in the victim's environment. The opportunistic hackers described in this section apply the same principle to AI. The actors treat the AI supply chain itself as both a target and a resource. They steal AI API keys from multiple target environments and use them to provide additional AI compute. In every case, the API keys involved were stolen from Anthropic customers' environments. Anthropic's own systems were not breached by this actor. We examine this pattern in detail in the AI supply chain section.

What the report observed

The report describes the attack lifecycle shared by these clusters: from credential harvesting to ransom monetization. It includes: sourcing and reconnaissance (most intrusions began with stolen credentials; actors also conducted broad scanning, vishing, phishing, and domain spoofing to trick employees into granting system access); discovery (exposed access tokens were discovered at industrial scale through various automated scraping and mining projects, including analyzing app binaries, code repositories and integrations, client-side code, credential stores, container images, metadata endpoints, open storage, and AI agents deployed by victims); validation/qualification (all findings were tested and qualified before use or resale, such as bulk cloud key validation, dedicated login oracles, live replay against production environments, resale value ratings, and offline cracking); lateral movement within the victim (one usable credential was used to expand access within the victim, for full cluster key dumps, admin token amplification, CI/CD injection, database and session table dumps, signing key mining dumps, and vendor OAuth fan-out to each downstream tenant); exfiltration channels (material was moved out through six channels: consumer cloud storage, private NAS via mesh VPN, Telegram bot streams, in-cloud victim staging, command and control channels, and plain bulk API pulls); warehousing (loot was warehoused for reuse and sale: a self-hosted infrastructure re-providing stolen databases, per-victim loot trees, a Telegram warehouse that also served as a storefront, and usable key storage); minting/persistence (minting new credentials and persistent access so operations continue after rotation: cloud API keys in victim accounts, platform developer keys, forged sessions and two-factor verification codes, web backdoors); monetization (monetization channels: resale channels and key pools, direct financial theft, ransom on stolen data, double-dipping bounty income, and bulk data held for leverage).

The report lists related indicators of compromise (domains, exfiltration locations, Telegram group IDs, attacker egress IPs, etc.) at the end for defenders to investigate. Per this site's safety boundaries, specific indicator values are not reproduced.

Confirmed & unknown

Platform response

Anthropic says it detected and banned accounts associated with these affiliated members, deployed measures to detect and disrupt future abuse, and engaged with government authorities, industry partners, and victims to address the threat posed by these actors.

Limits of response：Banning accounts cannot recover data that has already been leaked or sold; the report does not state whether any victims paid ransoms, nor does it give the total financial losses in this case.