The gang, which emerged last month and has claimed 108 victims on its leak site, tried to break into 23 organisations across 14 countries. Despite spending more than $7,216 on AI services by October 22, using the open-source OpenCode coding agent configured with 154 model entries across seven providers, the crew did not exploit a single software bug. "In every documented compromise in this investigation, access relied on weak or stolen credentials," said Ensar Seker, SOCRadar's chief information security officer. Entry came via Remote Desktop Protocol scanning, automated FortiGate VPN credential stuffing, exposed cloud credentials and reused sessions.

The AI was used to write and debug hundreds of scripts, helping turn basic access into a broader, tailored operation, according to Seker. The attacks were also destructive in some cases: the operator deleted data and backups, and in one case changed firewall policies to block traffic. In one case linked to e-commerce site Fanatics, an exposed AWS access key was used to pull data from 40 S3 buckets, up to 110 GB per bucket, then delete bank-transaction archives and purge keys across 12 sensitive buckets. Separately, the crew gained entry to US IT managed services provider ChiBiTek using a 15-thread residential proxy pool to test credentials against FortiGate portals.

The group's bark appears bigger than its bite so far. It added 38 maritime, port and logistics organisations across 18 countries to its leak site in one batch on October 12, with ransom demands from $400,000 to $28 million in Bitcoin and an October 19 deadline. After the deadline, none of the listings were marked settled and no payment addresses showed any transaction; all the stolen data was published. SOCRadar rates the gang 10 out of 10 for aggressiveness and zero for lethality, and has not validated any of the few "honoured" claims on-chain.