Ledger / Dec 2024
FunkSec ransomware group builds tools with AI assistance
Strong
Check Point attributes AI-assisted development from code artifacts; no model named on the report page.
Check Point reported a fast-rising ransomware group whose encryptor and tooling appear AI-assisted, letting a relatively inexperienced author iterate quickly. Code comments in unusually perfect English were cited as a tell.
“FunkSec operators appear to use AI-assisted malware development which can enable even inexperienced actors to quickly produce and refine advanced tools.”Check Point Research
Sources
- FunkSec: alleged top ransomware group powered by AICheck Point Research · 10 Jan 2025 · primary source
- Date
- Dec 2024
- Disclosed
- 10 Jan 2025
- Actor
- FunkSec (criminal), as attributed by Check Point Research
- Nexus
- Algeria
- Targets
- Global victims across sectors, 85+ leak-site victims in Dec 2024
- What the AI did
- Malware dev
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- Rust ransomware, double extortion and DDoS tooling; some claimed leaks recycled from earlier hacktivism.