Case funksec-ai-assisted-ransomwareAI-assisted malwareWorldwide
Check Point: FunkSec ransomware group built its Rust encryptor with AI assistance
Check Point Research found that FunkSec, a RaaS group that claimed 85 victims in December 2024, likely developed its Rust encryptor and tooling with AI help, letting an inexperienced author iterate fast.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 10, 2025
- Location
- Worldwide
- Target
- 85+ organisations listed on FunkSec leak site
- Severity
- High
- Triggered by
- FunkSec (DesertStorm persona)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Check Point Research found that FunkSec, a RaaS group that claimed 85 victims in December 2024, likely developed its Rust encryptor and tooling with AI help, letting an inexperienced author iterate fast.
Impact: More than 85 claimed victims in about a month, though Check Point judged real impact modest and noted many leaked datasets were recycled from earlier hacktivist leaks. V1.5 was detected by only 3 antivirus engines at upload.
Who triggered it
Actor: FunkSec (DesertStorm persona)
Attribution: Check Point Research assessed the developer is likely an inexperienced author based in Algeria, citing Ghost Algeria references and upload sources; Kaspersky later made similar AI-code observations.
Motive: Financial extortion mixed with hacktivist posturing; ransom demands as low as 10,000 USD
How it happened
Attack vector: Double-extortion ransomware (FunkSec V1.5, Rust) plus Python DDoS tool, HVNC remote access tool and a password scraping tool, all showing AI-generated code traits
Root cause: Generative AI lowered the skill needed to produce a working encryptor; code had polished English comments while operators showed weak English, and the group ran its own Miniapps chatbot for malicious tasks
Timeline
- FunkSec data leak site launches and lists 85 claimed victims within the month
- Check Point Research publishes analysis calling the tooling likely AI-assisted
- Kaspersky publishes its own FunkSec analysis noting LLM-style placeholder comments
Response
Check Point published IOCs and detection guidance; the report flagged AI-assisted tooling as a sign that novices can produce functional ransomware quickly.
Current status: Ongoing
Sources (open in a new tab)
- Check Point Research research.checkpoint.com
- The Hacker News thehackernews.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
Check Point: FunkSec ransomware group built its Rust encryptor with AI assistance. AI Threat Watch, case funksec-ai-assisted-ransomware, Jan 10, 2025. https://aithreat.io/cases/funksec-ai-assisted-ransomware/
Permanent link: https://aithreat.io/cases/funksec-ai-assisted-ransomware/