Check Point Says The Gentlemen Used AI to Scale Ransomware Operations

Check Point Research reported that AI has moved beyond a supporting role and is now acting as an operational component in live intrusions, helping attackers with reconnaissance, exploit development, phishing, vishing, lateral movement, and data theft. The firm said criminal groups have used AI as a primary operator in some campaigns, and cited The Gentlemen ransomware group as an example of actors using AI to accelerate internal tool creation, while attackers also abuse commercial models, agentic architectures, and jailbroken systems before pivoting to alternative platforms when safeguards block malicious activity. The report added that enterprise exposure is rising as indirect prompt injection increases and high-risk generative AI prompts have doubled over the past year.

The findings coincide with a broader surge in ransomware activity. Check Point said The Gentlemen accounted for 17% of published ransomware attacks in June, making it the most active group globally, while recent victim reports linked the gang to attacks on Open Options, a Texas software company associated with the ooaccess.com domain, and INTERNET AG, a German IT services and hosting provider using inet.de. Microsoft had previously said state-backed actors were using large language models mainly as productivity aids rather than for novel tradecraft, but Check Point's 2026 assessment indicates AI is now materially accelerating criminal operations even if fully autonomous hacking has not yet emerged.