Ransomware Crews Are Using the Client’s Own AI

Ransomware crews that already have a foothold are using a company’s own generative AI tools to sort stolen files and speed the rest of the attack. The models are rarely the way in.

Lauren Winchester, head of cyber risk services at Travelers, said they are extra kit waiting on the network once someone is inside. Attackers live off the land, she said, and generative AI is now one of the tools they look for with the credentials they already stole.

Ransomware Crews Now Use the Client’s Own Chat Apps

Living off the land used to mean PowerShell, built-in admin tools, and whatever else a stolen account could already run. Winchester told brokers the same habit now includes GenAI that the company rolled out for writing, search, and file summary. The attacker does not have to smuggle a new model past the firewall if Copilot, ChatGPT, Claude, or a house LLM is already licensed and logged in.

What we have seen ransomware threat actors do is, once they’re inside an environment, they sometimes live off the land. They look for what tools are available to them with the credentials they have. So, if there’s available GenAI within the environment, they might use it to make their lives easier.

Lauren Winchester, head of cyber risk services, Travelers

That still leaves multifactor authentication, phishing, and unpatched edge devices as the usual front doors. The change is what happens after the door is open. A model that can read mail, tickets, and shared drives becomes a quiet analyst for whoever holds the session.

Winchester also flagged staff who paste client files into public chat tools the company never approved. Internally built models create a second path when their permissions are wide and nobody has listed what they can retrieve. Both sit outside the old cyber application, which asked about backups and MFA and almost never asked who can query the bot.

The FBI Logged 22,364 AI-Related Complaints in 2025

The FBI’s Internet Crime Complaint Center put an AI section in its annual report for the first time when it released the 2025 figures on April 6, 2026. Scammers used fake profiles, voice clones, fake IDs, and videos of public figures or relatives, the bureau said, and it asked the public to pause before sending money.

THE 2025 IC3 TALLY

Those AI filings are the ones complainants themselves tied to AI. The bureau has said the true count is likely higher because many victims never know a model wrote the lure. Ransomware’s cash line also understates the bill, because it leaves out downtime, rebuild work, and legal costs.

Complaint volume rose from 859,532 in 2024. Americans over 60 reported about $7.7 billion in losses, up 37%. About 453,000 filings were cyber-enabled fraud, with losses exceeding $17.7 billion. The AI slice is smaller than crypto and smaller than BEC, which is the point for underwriters: the new descriptor is real, and it is not yet the whole book.

The 22,364 AI-related fraud complaints still matter at renewal because they show the bureau is now tagging AI the way it already tags crypto. Brokers who never ask how a client uses models are ignoring a category the FBI chose to name.

What Brokers Should Ask Before a Cyber Renewal

Cyber applications still orbit MFA, endpoint detection, backups, and patching. Winchester said the next conversation should also cover how AI is deployed, what jobs it does, and what risk work has been done while it was being stood up. Those questions often expose tools that never went through security review.

QUESTIONS FOR THE RENEWAL FILE

• Approved tools: Which third-party apps and house models are in production, and which business units own them.
• Who can query: Which staff and which service accounts can open the chat apps, and whether that access is logged.
• What the model can reach: Mail, file shares, tickets, and customer records the assistant is allowed to retrieve.
• Shadow use: Whether staff paste confidential files into public chat tools the company did not buy.
• Risk work already done: Any inventory, acceptable-use rule, or test against the NIST AI Risk Management Framework, first issued on January 26, 2023, and the generative AI profile added on July 26, 2024.

NIST’s framework is voluntary. It still gives a broker a shared list, Govern, Map, Measure, Manage, instead of a vague request to “do AI governance.” A client that cannot name the models on its network is not ready for a questionnaire that now treats those models as part of the attack surface.

How Attackers Turn Copilot Into a Data Analyst

Winchester’s sharpest operational point is what crews do with stolen data. Ransomware groups have long copied large stores before they encrypt. They used to boast about volume. They now name the sensitive contents.

“Now you’re starting to see threat actors actually say, ‘We have 10 terabytes of data, and we know we have X, Y and Z sensitive data,’” Winchester said. “That suggests some AI usage to comb through that data and really quickly understand what they may have obtained.”

Token Theft From ChatGPT, Claude, and Copilot

Lumia Security Labs, in a November 12, 2025 note that later fed MITRE’s ATLAS matrix, showed how that combing can start on a single compromised laptop. ChatGPT, Claude, and Microsoft 365 Copilot desktop apps are Chromium-based. After the machine is owned, an attacker can harvest tokens from GenAI desktop apps and call the backend as the user.

The quietest move is to pull conversation history. Those threads often hold the files and prompts the user already trusted the assistant with, which means the thief may never need a noisy search across file servers. Lumia also described injecting hidden prompts, planting lasting “memories,” and deleting chats so the user blames a glitch.

Treat those sessions as crown-jewel accounts, not as a writing toy. If the desktop app stays logged in, the model is a remote data store with the user’s rights.

Ransom Notes That Name Specific Files

SentinelLABS found crews using the same office workflows companies bought the tools for: draft the note, translate it, and mine a dump for what will hurt. A Russian-speaking operator may miss that a file named Rechnung is an invoice. A model asked to find debt or trade secrets in German, Turkish, or Japanese does not miss it.

In August 2025, Anthropic’s threat team described an extortion campaign in which Claude Code was told to pick what to steal, set a ransom figure, and shape the demand. Mid-2025, Global Group’s ransomware-as-a-service offering advertised “AI-Assisted Chat” that claimed to read a victim’s revenue and public behavior before talking to them.

WHERE EXPERTS DISAGREE

• SentinelLABS: Large language models speed phishing, data sorting, and negotiation, but have not, at scale, created a new class of tactic.
• Google Threat Intelligence Group: 2025 was the first year it saw malware families call an LLM while running, including PROMPTSTEAL in live operations and experimental droppers that ask a model to rewrite themselves.

Both can be true in the same year. The insurance problem Winchester is naming does not need a self-rewriting worm. It only needs a logged-in assistant that can read the files the company already gave it.

SesameOp Hid Command Traffic Inside OpenAI

Microsoft Incident Response’s Detection and Response Team, working a case it entered in July 2025, found a backdoor it named SesameOp. A loader, Netapi64.dll, dropped a.NET implant, OpenAIAgent.Netapi64, that used the OpenAI Assistants API as a C2 channel instead of a classic malware server. Microsoft published the write-up on November 3, 2025. OpenAI disabled the API key. The review found that account had not used models beyond limited API calls.

Traffic that looks like a normal AI vendor is harder for a proxy to block, and harder for a junior analyst to love as a lead. That is living off the land one layer up, in SaaS rather than in Windows binaries.

Google’s tracker described a parallel habit on the host itself. QUIETVAULT, called out in August 2025, is a JavaScript stealer that finds local AI command-line tools and prompts them to hunt wallet files and secrets, then opens a GitHub repo to ship what it finds. PROMPTSTEAL, used by APT28 against Ukraine in June 2025, queried an LLM through Hugging Face for the exact commands to run. One prompt asked only for a one-line copy of office and PDF files from Documents, Downloads, and Desktop into a staging folder.

THE 2025 AI ABUSE TIMELINE

1. June 2025: Google reports PROMPTSTEAL querying an LLM for live collection commands.
2. July 2025: Microsoft DART finds SesameOp using OpenAI’s Assistants API for command and control.
3. August 2025: QUIETVAULT abuses on-host AI CLIs; Anthropic describes a Claude Code extortion flow.
4. November 3, 2025: Microsoft publishes the SesameOp case.
5. November 12, 2025: Lumia publishes AIKatz against ChatGPT, Claude, and Copilot desktop apps.
6. April 6, 2026: The FBI releases the first IC3 annual report with an AI section.

None of those cases require the company’s AI platform to be the original hole. They require it to be present, trusted, and useful, which is exactly why it was purchased.

A 30-Day Patch Window No Longer Matches the Clock

Winchester’s control list will sound familiar to anyone who has filled a cyber application. The time allowed has changed. “You can’t rely on a 30-day patch timeline,” she said. “You need to do it right away.”

The FBI’s public advice matches that urgency: patch known exploited flaws on internet-facing systems first, run endpoint detection and response, and turn on MFA, especially for webmail, VPNs, and accounts that reach critical systems. CISA’s joint ransomware guide tells firms to prioritize patching known exploited vulnerabilities on those same edge boxes, and to prefer phishing-resistant MFA over codes that a proxy can steal.

CONTROLS THAT STILL MOVE THE ODDS

• Edge patching: Known exploited flaws on VPNs, firewalls, and other internet-facing gear get fixed as soon as a usable patch exists, not on a monthly cycle.
• Phishing-resistant MFA: Hardware keys or passkeys on admin, webmail, VPN, and other high-value paths, with SMS treated as a last resort.
• EDR on every asset: Look for odd use of legit tools, including sudden spikes in AI-app traffic or token dumps from desktop chat clients.
• Least privilege for agents: An assistant that was granted broad rights because it “needs access to everything to be helpful” is a new service account. If that identity is stolen, it is a shortcut across mail, files, and SaaS.

That last item is the one most applications still miss. Crews do not need a new exploit for Copilot if Copilot already has the keys. Narrow what the assistant can read, log the queries, and kill standing desktop sessions on laptops that fail a posture check.

Carrier Services Brokers Can Use at Renewal

Winchester’s close to brokers was practical. Many carriers already sell, or give away, scans, alerts, and people who can walk a client through an AI inventory. “I would advise all brokers to make sure they understand what services are available from the carriers they’re placing their clients’ cyber business with,” she said. “There are a lot of free resources and experts out there that can work with their clients.”

Travelers’ own Cyber Risk Services, included for CyberRisk policyholders, include always-on threat monitoring, an in-house team, and a dashboard that stays up around the clock. The company says policyholders who use those services reduce the risk of a breach by almost 20%. Its renewal guide tells firms to start about three months out and to put someone on the file who actually knows the current network, not only the last application’s answers.

A scan of what faces the internet will not, by itself, list every Copilot seat or every staffer using a personal ChatGPT login. It still beats a renewal pack that never mentions AI. The broker who adds Winchester’s questions, then spends the carrier’s free hours on an inventory of models, access, and data flows, is doing the work the old MFA-and-backups form no longer covers.

The next application that cannot say which staff can query the company assistant, and which records that assistant can reach, is already behind the incident it is trying to price.

Disclaimer: This article is news reporting and analysis of cyber risk and insurance practice, and it is for information only. It is not insurance advice, underwriting guidance, legal advice, or a recommendation to buy, change, or drop a cyber policy, and it is not a substitute for a technical security assessment. Readers should consult a licensed insurance broker or agent, and a qualified cybersecurity professional, before changing controls, applications, or coverage. Figures, product terms, and threat descriptions reflect the cited FBI, CISA, carrier, and research materials as of the dates on those documents and may change.