SOCRadar Finds AI-Managed Ransomware Operation Targeting 62 Organizations

Researchers have identified a ransomware operation that targeted 62 organizations using a workflow in which human operators approved steps executed through commercial AI models. The campaign demonstrates how agentic tools can compress intrusion workflows while retaining human command over critical decisions.

The operation relied on AI to handle technical tasks within the attack chain, but a human remained in the loop to authorize each action. This structure allowed the group to move faster than traditional manual methods without fully automating the decision-making process. The findings highlight a shift in how threat actors are adopting commercially available AI systems to reduce the time and effort required for intrusions.

For sectors such as insurance, legal, IT, and operations, the development signals that response and underwriting models may need to account for attacks that blend machine speed with human oversight. The research confirms that agentic AI is being used in live criminal campaigns, not just theoretical exercises, and that the barrier to faster, more efficient ransomware operations is lowering as commercial models become more accessible.