{"schema_version":"0.9.0","id":"LR-2026-0249","record_version":2,"title":"Silent Ransom Group used ChatGPT to research extortion victims and draft recruitment material","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.48,"unhedged_language":4.26},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":"ChatGPT","model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"suggest","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Researching historical settlements and fines, gathering information about buildings, drafting recruitment adverts, and researching US military installations and defence manufacturers.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-02-06","date_disclosed":"2026-10-28","incident_class":"harmful_output","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"GuidePoint Security analysed leaked Silent Ransom Group messages and found eight containing signs of ChatGPT-copied content, used for researching settlements and fines, building information, recruitment adverts and US military installations.","tags":["extortion","ransomware-group-abuse","leaked-chats"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate: The group's internal ledger lists 50 organisations, 27 marked as paid, a scope spanning many third parties.","harm_class":["financial","privacy"],"affected_description":"50 organisations listed in an internal ledger between February and September 2026; US law firms targeted by the group","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.co.uk/silent-ransom-group-chatgpt-victim-research-extortion-1809448","publisher":"www.techtimes.co.uk","date":"2026-10-28","type":"press","title":"Cybercrime Gang Allegedly Used ChatGPT To Research Targets as FBI Details Its Extortion Tactics","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.intended_use":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_occurred":"C","event.tags":"D","event.responsible_party":"D","event.adversarial_actor":"C","event.agent_involved":"C","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"C","impact.affected_description":"C","impact.severity":"D","context.industry":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"A cybercrime group accused of extorting businesses allegedly used ChatGPT to research potential victims, examine historical settlements and fines, and prepare recruitment adverts, according to leaked internal messages analysed by cybersecurity researchers."}],"system.developer":[{"source_index":0,"quote":"A cybercrime group accused of extorting businesses allegedly used ChatGPT to research potential victims, examine historical settlements and fines, and prepare recruitment adverts, according to leaked internal messages analysed by cybersecurity researchers."}],"system.intended_use":[{"source_index":0,"quote":"The exchanges pointed to four uses: researching historical settlements and fines, gathering information about buildings, drafting recruitment adverts, and researching US military installations and defence manufacturers."}],"system.autonomy_level":[{"source_index":0,"quote":"The findings instead point to an administrative and research role for the technology in the eight identified messages, supporting human operators rather than independently carrying out attacks."}],"system.deployment_context":[{"source_index":0,"quote":"The findings instead point to an administrative and research role for the technology in the eight identified messages, supporting human operators rather than independently carrying out attacks."}],"event.date_occurred":[{"source_index":0,"quote":"One conversation dated 6 February 2026 contained a table of settlements and fines paid by law firms, including figures of $8 million (£6 million), $1.4 million (£1.05 million), $150,000 (£113,000) and smaller sums."}],"event.detection_method":[{"source_index":0,"quote":"The AI-related findings come from a separate investigation by GuidePoint Security, which examined thousands of messages attributed to the Silent Ransom Group."}],"event.summary":[{"source_index":0,"quote":"GuidePoint Security's analysis of the leaked chats identified eight messages containing signs that content had been copied from ChatGPT."}],"event.adversarial_actor":[{"source_index":0,"quote":"A cybercrime group accused of extorting businesses allegedly used ChatGPT to research potential victims, examine historical settlements and fines, and prepare recruitment adverts, according to leaked internal messages analysed by cybersecurity researchers."}],"event.agent_involved":[{"source_index":0,"quote":"The findings instead point to an administrative and research role for the technology in the eight identified messages, supporting human operators rather than independently carrying out attacks."}],"event.incident_class":[{"source_index":0,"quote":"The exchanges pointed to four uses: researching historical settlements and fines, gathering information about buildings, drafting recruitment adverts, and researching US military installations and defence manufacturers."}],"event.responsible_party":[{"source_index":0,"quote":"A cybercrime group accused of extorting businesses allegedly used ChatGPT to research potential victims, examine historical settlements and fines, and prepare recruitment adverts, according to leaked internal messages analysed by cybersecurity researchers."}],"event.tags":[{"source_index":0,"quote":"A cybercrime group accused of extorting businesses allegedly used ChatGPT to research potential victims, examine historical settlements and fines, and prepare recruitment adverts, according to leaked internal messages analysed by cybersecurity researchers."},{"source_index":0,"quote":"The FBI document released through the FOIA request identifies the Silent Ransom Group, also known as Luna Moth, Chatty Spider and UNC3753, as a threat actor targeting law firms through social engineering."},{"source_index":0,"quote":"GuidePoint Security's analysis of the leaked chats identified eight messages containing signs that content had been copied from ChatGPT."}],"impact.harm_class":[{"source_index":0,"quote":"The stolen material is then used to pressure organisations into paying."},{"source_index":0,"quote":"The criminals threaten to publish or sell confidential files and may contact employees or clients to push negotiations forward."}],"impact.affected_description":[{"source_index":0,"quote":"GuidePoint's review of 5,692 messages found an internal ledger listing 50 organisations between February and September 2026."}],"impact.severity_because":[{"source_index":0,"quote":"GuidePoint's review of 5,692 messages found an internal ledger listing 50 organisations between February and September 2026."}],"context.industry":[{"source_index":0,"quote":"Separately, an FBI intelligence document released through a Freedom of Information Act request describes how the group targets US law firms by posing as IT support workers."}],"context.country":[{"source_index":0,"quote":"Separately, an FBI intelligence document released through a Freedom of Information Act request describes how the group targets US law firms by posing as IT support workers."}],"impact.severity":[{"source_index":0,"quote":"GuidePoint's review of 5,692 messages found an internal ledger listing 50 organisations between February and September 2026."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"No source states the model version, harness, tools granted, permissions scope, guardrails present, lifecycle stage, integration type, safeguard state, production intent, date disclosed, failure class, trigger, root cause, duration, time to contain, operations paused, remediation, precursor events, direct loss figure, records exposed, third-party count, reversibility, org size, denominator, systemic exposure, regulatory or coverage details. event.incident_class is classified from the stated use of ChatGPT to draft recruitment adverts and research targets for an extortion group; no source states the system refused or should have refused. event.responsible_party is classified as third_party because the misuse was by the criminal group, not the provider or a deployer. event.agent_involved is false per the source's statement that the technology supported human operators rather than acting independently. The $206.95 million is a claimed, unverified extortion ledger, not a stated direct loss, so direct_loss_usd is null; severity major rests on the many third parties in the ledger. No source states who first noticed the ChatGPT use beyond GuidePoint's investigation, which is treated as public_researcher detection. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.developer: no source names the developer. system.autonomy_level: classified from described behaviour. system.deployment_context: no source states where it ran. event.tags: classified from described behaviour. event.responsible_party: classified from described behaviour. event.detection_method: a source states an independent researcher or journalist found it. event.incident_class: classified from described behaviour. event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident."},"context":{"industry":"Legal services","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The Silent Ransom Group, a cybercrime gang, allegedly used ChatGPT to research victims' settlements and fines, building operations, recruitment adverts and US military installations, supporting human operators rather than acting autonomously.","quote":"The findings instead point to an administrative and research role for the technology in the eight identified messages, supporting human operators rather than independently carrying out attacks.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The group used ChatGPT research to support extortion of law firms, impersonating IT staff to gain remote access and copying confidential data, though the chats do not show ChatGPT itself executing attacks.","quote":"The leaked chats do not establish that ChatGPT independently selected victims, negotiated payments or executed attacks.","source_index":0,"grade":"C"},{"step":"reached","text":"The group targeted US law firms, copying confidential information and threatening to publish or sell files, with an internal ledger listing 50 organisations and claimed payments of $206.95 million.","quote":"Twenty-seven had entries marked as payments received, with the operators claiming a combined $206.95 million (£155.2 million).","source_index":0,"grade":"C"},{"step":"caught","text":"GuidePoint Security researchers found the ChatGPT use by analysing thousands of leaked Silent Ransom Group messages; the FBI separately documented the group's tactics.","quote":"The AI-related findings come from a separate investigation by GuidePoint Security, which examined thousands of messages attributed to the Silent Ransom Group.","source_index":0,"grade":"C"},{"step":"done","text":"The FBI recommends verifying IT support identities, training staff on phishing, restricting sensitive system access and controlling remote-access software and external storage devices; no containment of the group is stated.","quote":"For businesses, the FBI recommends verifying the identity of anyone claiming to provide IT support, training staff to recognise phishing attempts and restricting access to sensitive systems.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://www.techtimes.co.uk/silent-ransom-group-chatgpt-victim-research-extortion-1809448"]}}