FunkSec ransomware group uses AI tools, claims 85+ victims globally
FunkSec, a ransomware group that debuted in late 2024, reportedly uses AI-assisted tools to encrypt data and conduct extortion attacks against over 85 victims worldwide. The group operates a ransomware-as-a-service platform and resells stolen data, with ransom demands reportedly starting as low as $10,000.
What happened
FunkSec, a ransomware group that emerged in late 2024, claims to have targeted more than 85 victims globally using AI-assisted tools. The group operates as both a ransomware operator and data broker, launching a data leak site in December 2024 to centralize operations.
FunkSec's approach combines double extortion tactics—encrypting victim data while threatening to sell it—with AI-driven malware development. The group's ransomware, FunkSec V1.5, is written in Rust and uses AI to automate encryption and evade security measures. The group also deploys distributed denial-of-service attack tools and operates a ransomware-as-a-service model offering affiliate access.
Reported impact
Victims face ransom demands as low as $10,000, with stolen data resold for $1,000 to $5,000. Primary targets include residents of the U.S., India, Italy, Brazil, Israel, Spain, and Mongolia.
Check Point Research assessed that FunkSec may be operated by novice actors using AI tools to compensate for limited technical expertise, while recycling leaked information from previous hacktivist-related breaches.
Index analysis
FunkSec's use of AI appears to enable rapid iteration in malware development despite operators' apparent lack of deep technical expertise. The group claims alignment with political movements such as 'Free Palestine' and attempts to associate itself with defunct hacktivist entities including Ghost Algeria.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.