Case anthropic-nocode-raasAI-assisted malwareWorldwide
Lone criminal sold Claude-built ransomware variants on forums for $400 to $1,200
A single actor with basic coding skills used Claude to develop, market and sell several ransomware variants with evasion, encryption and anti-recovery features, packaged for $400 to $1,200 on underground forums.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 27, 2025
- Location
- Worldwide
- Target
- Buyers' victims via ransomware-as-a-service
- Severity
- High
- Triggered by
- Unknown individual
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
A single actor with basic coding skills used Claude to develop, market and sell several ransomware variants with evasion, encryption and anti-recovery features, packaged for $400 to $1,200 on underground forums.
Impact: Functional ransomware offered to other criminals; number of deployments and victims not published.
Who triggered it
Actor: Unknown individual
Attribution: Anthropic Threat Intelligence; single cybercriminal who could not have built the core components without Claude.
Motive: Profit from ransomware-as-a-service sales
How it happened
Attack vector: Claude generated encryption routines, anti-analysis techniques and Windows internals code the actor could not write alone
Root cause: Actor lacked skills to build the components independently; malware-generation detection was insufficient at the time
Timeline
- Sales offering for the ransomware packages observed on forums
- Anthropic discloses the case and bans the account
Response
Account banned, partners alerted, new detections for malware upload, modification and generation deployed.
Current status: Contained
Sources (open in a new tab)
- Anthropic August 2025 threat report anthropic.com
- heise coverage heise.de
Cite this case
Lone criminal sold Claude-built ransomware variants on forums for $400 to $1,200. AI Threat Watch, case anthropic-nocode-raas, Aug 27, 2025. https://aithreat.io/cases/anthropic-nocode-raas/
Permanent link: https://aithreat.io/cases/anthropic-nocode-raas/