A cybercrime group accused of extorting businesses allegedly used ChatGPT to research potential victims, examine historical settlements and fines, and prepare recruitment adverts, according to leaked internal messages analysed by cybersecurity researchers.
The findings offer a look at how artificial intelligence may be helping criminals organise their work, even when their methods rely on impersonation and stolen information rather than sophisticated hacking tools.
The AI-related findings come from a separate investigation by GuidePoint Security, which examined thousands of messages attributed to the Silent Ransom Group. Its analysis suggests that ChatGPT was used for several practical tasks, although the conversations do not establish that every proposed operation was carried out.
The distinction matters because the leaked messages contain both records of apparent activity and plans that may never have progressed beyond discussion.
Separately, an FBI intelligence document released through a Freedom of Information Act request describes how the group targets US law firms by posing as IT support workers. Its methods include phone calls, phishing emails and, in some cases, sending people directly to victims' offices.
How the Silent Ransom Group Allegedly Used ChatGPT
GuidePoint Security's analysis of the leaked chats identified eight messages containing signs that content had been copied from ChatGPT. The exchanges pointed to four uses: researching historical settlements and fines, gathering information about buildings, drafting recruitment adverts, and researching US military installations and defence manufacturers.
One conversation dated 6 February 2026 contained a table of settlements and fines paid by law firms, including figures of $8 million (£6 million), $1.4 million (£1.05 million), $150,000 (£113,000) and smaller sums. GuidePoint noted that an entry for one of the firms had appeared in the group's internal ledger 19 minutes earlier.
The timing suggests the research may have been connected to the group's extortion work, although the messages do not establish that ChatGPT set a ransom demand or determined how much a victim should pay.
Another exchange sought information about who managed air-conditioning filter changes at a named Manhattan building, including the facilities companies involved. Such details could help someone understand a property's operations, although the messages alone do not prove that the information was used to gain access.
The researchers also found recruitment copy for nightclub promoters in Miami, Orlando and New York. In a separate session dated 23 September 2026, the group researched US military installations and defence manufacturers, eventually producing a table distinguishing drone makers from companies supplying components.
GuidePoint found no evidence that the group used ChatGPT to develop malware in the reviewed conversations. The findings instead point to an administrative and research role for the technology in the eight identified messages, supporting human operators rather than independently carrying out attacks.
FBI Files Detail the Group's IT Impersonation Tactics
The FBI document released through the FOIA request identifies the Silent Ransom Group, also known as Luna Moth, Chatty Spider and UNC3753, as a threat actor targeting law firms through social engineering.
The intelligence notice was circulated in May 2026 and describes the group's activity as data theft and extortion rather than conventional ransomware encryption.
According to the FBI, criminals contact employees while pretending to work in the company's IT department and try to persuade staff to grant remote access to their computers. If that approach fails, a person may be sent to the victim's workplace to connect a storage device to a computer.
Once inside a system, the group seeks to copy confidential information quickly. The FBI says its operators have used legitimate remote-access software and file-sharing platforms, making it harder to identify an intrusion through conventional security alerts alone.
The stolen material is then used to pressure organisations into paying. The criminals threaten to publish or sell confidential files and may contact employees or clients to push negotiations forward. This approach means a company can face an extortion attempt even if its systems have not been encrypted or rendered unusable.
GuidePoint's separate analysis describes an operation that also relies on people recruited to carry out in-person tasks. The researchers found discussions about forged identification documents and arrangements for helpers to visit offices.
These details suggest that physical access and convincing impersonation can be as important to the operation as technical access.
Leaked Ransom Records Claim More Than $200 Million
GuidePoint's review of 5,692 messages found an internal ledger listing 50 organisations between February and September 2026. Twenty-seven had entries marked as payments received, with the operators claiming a combined $206.95 million (£155.2 million).
That figure remains unverified. GuidePoint said it had not independently confirmed the payments through blockchain analysis, and the records were produced by the alleged criminals themselves. They should therefore be treated as claims in an internal ledger, not as an established total of money collected.
The researchers also found that the group tracked its targets using information from professional networking sites, company websites and commercial databases. Its records included details about senior executives, company revenue and security products, indicating an effort to understand potential victims before approaching them.
For businesses, the FBI recommends verifying the identity of anyone claiming to provide IT support, training staff to recognise phishing attempts and restricting access to sensitive systems. Organisations should also control the installation of remote-access software and external storage devices.
The leaked chats do not establish that ChatGPT independently selected victims, negotiated payments or executed attacks. They suggest that criminals may be using widely available AI tools to speed up research and prepare material for operations that still depend on human deception.
That distinction is important as businesses assess how AI could change the practical work involved in cybercrime.
