FunkSec ransomware group uses AI to develop malware and conduct extortion
FunkSec, a newly identified ransomware group, reportedly uses AI-assisted malware development to conduct double-extortion attacks against companies worldwide, claiming over 85 victims in December 2024. Security researchers at Check Point have questioned the authenticity of some claimed victims, while noting the group's use of large language models to enhance its attack capabilities.
What happened
FunkSec is a ransomware-as-a-service (RaaS) group that emerged in late 2024 and uses AI-assisted malware development to create and improve attack tools. The group published information on more than 85 victims in December 2024 alone, claiming responsibility for 14 percent of ransomware attacks that month.
FunkSec operators use large language model agents to generate code comments and AI agents to develop their ransomware, enabling less experienced actors to produce sophisticated cyberattack tools. The group employs double extortion techniques combining data theft with encryption to extort victims.
Reported impact
More than 20 percent of FunkSec's victims in December 2024 were located in the United States, followed by India (16 percent) and Italy (5 percent). The group's attack volume exceeded that of other ransomware groups operating in the same period.
Index analysis
Check Point Research has questioned the credibility of FunkSec's victim claims, noting that many of the disclosed victims may involve recycled or unverified data. FunkSec appears to be linked to Algeria and motivated by both financial gain and hacktivist ideology.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.