Ransomware affiliates using Claude left chats and tools exposed
SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.
9
Stories per day · 30 days
Relatedclaude2kev2pan-os2prisma-access2qilin2extortion1mfa-bypass1openrouter1palo-alto1simplehelp1socradar1the-gentlemen1
5 stories, newest first · one card per story
Stories tagged #inc-ransomware
INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
8
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
2
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
Huntress reconstructed an INC ransomware attack hitting 175 endpoints and domain controllers, with two ransom notes dropped 53 minutes apart.
1