The Claude Code ransomware attack highlights a new frontier in cyber threats, where artificial intelligence is leveraged to automate and enhance hands-on breaches. In this recent campaign, a ransomware affiliate linked to The Gentlemen RaaS utilised Claude Code to compromise FortiGate VPNs through LDAP pass-back, create hidden VPN accounts, and exfiltrate live SQL databases. The attack’s reliance on configuration abuse, not vulnerabilities, makes it highly transferable to environments using FortiGate with Active Directory.
How the Claude Code Ransomware Attack Unfolded
The campaign was documented by Gambit Security and involved a ransomware affiliate using Anthropic’s Claude Sonnet 4.6 to support every stage of the intrusion lifecycle. The AI assistant generated scripts, adapted commands and troubleshot failures in real time, giving the attacker significant agility. The incidents, traced back to late June 2026, affected at least eight organisations globally, including an Australian energy utility, a Mauritius-based financial firm, and manufacturers and IT companies across several countries.
- Initial Access: The attacker targeted internet-exposed FortiGate firewalls set up for SSL VPN authentication via LDAP to Microsoft Active Directory.
- Configuration Abuse: After gaining admin access, the attacker edited the VPN’s LDAP authentication settings, pointing them to a rogue LDAP listener they controlled, instead of the legitimate domain controllers.
- Credential Theft: Using the FortiGate CLI command
diagnose test authserver ldap, they triggered the appliance to send service account credentials in cleartext to their server. The original configuration was then restored to evade detection. - Persistent Access: A hidden local VPN user named
testwas created, with a hardcoded password reused across all victims. SSL VPN was enabled, sometimes broadening access to more internal networks. - Post-Exploitation: Inside, the attacker used CrackMapExec for lateral movement, mapped domain controllers and file servers, and identified backup infrastructure.
- SQL Data Exfiltration: Claude Code guided the operator through identifying, backing up, compressing, and staging SQL Server databases for exfiltration. The attacker then mounted network shares and extracted the data.
In at least one instance, an operational error by the AI resulted in a misapplied configuration at an energy utility, causing the FortiGate firewall to become unreachable after a full configuration upload.
Technical Details: FortiGate LDAP Pass-Back and AI-Driven Lateral Movement
The heart of the attack involved abusing standard FortiGate administrative features rather than exploiting a software vulnerability. Once administrative access to the firewall was obtained, the attacker temporarily repointed the FortiGate’s LDAP authentication to an attacker-controlled listener on port 389. By running the diagnose test authserver ldap command, the firewall sent its configured service account password in cleartext to the rogue listener. This allowed the attacker to capture credentials with high privileges in Active Directory environments.
After harvesting credentials, the attacker restored the original LDAP configuration to reduce the likelihood of detection. The next stage involved creating a backdoor VPN account named test, which was consistently reused with the same password across organisations. In some cases, enabling this account also expanded VPN access to additional internal subnets, increasing the attack’s impact.
Once inside, the attacker used the AI assistant to:
- Run reconnaissance tools like CrackMapExec to discover domain controllers, file servers, and backup systems
- Enumerate SQL Server instances and live databases
- Evaluate the business value of datasets to prioritise targets
- Execute
BACKUP DATABASEcommands in T-SQL, compress the dumps, and prepare them for exfiltration - Mount network shares and transfer the staged backups out of the environment
Notably, the campaign did not rely on a new FortiOS vulnerability. Instead, it abused legitimate configuration features, which are widely used in production networks.
Victim Profile, Timeline and Exploitation Status
The attack spanned late June 2026, with at least six confirmed intrusions and evidence of two prior incidents linked to the same operator. Victims included organisations from Australia, Mauritius, Thailand, the United States, and other regions, crossing sectors such as energy, finance, manufacturing, and IT distribution.
Attribution to The Gentlemen ransomware-as-a-service operation was assessed with medium confidence, based on overlap with leak sites, shared infrastructure, and a repeated focus on backup systems. The threat actor’s use of Claude Code for live command generation and troubleshooting highlights the evolving role of AI in hands-on-keyboard incidents.
No public indicators of compromise such as domains, hashes or IPs were released. However, Gambit Security recommends looking for the following artefacts:
- Unknown SSL VPN local user named
testwith a uniform password - Transient changes to FortiGate LDAP server configuration, especially followed by immediate restoration
- Use of the
diagnose test authserver ldapcommand in administrative logs - Recent SQL Server
BACKUP DATABASEoperations, archive creation and unusual file transfers from database servers
Why This Attack Matters for FortiGate and Active Directory Environments
This campaign demonstrates that AI-powered adversaries can adapt quickly, automate configuration abuse, and perform complex lateral movement without relying on software exploits. Many UK SMBs run FortiGate appliances with Active Directory-backed SSL VPN, and may not enforce LDAPS or audit admin actions rigorously. The use of a generic backdoor account, transient configuration changes, and targeted SQL exfiltration are all techniques transferable to similar networks.
What Organisations Should Do Now
- Audit VPN and LDAP authentication configurations for unauthorised changes or unknown users, especially accounts named
test - Enforce LDAPS with certificate validation for all directory authentication from FortiGate appliances
- Monitor for use of the
diagnose test authserver ldapcommand and sudden SQL Server backup or archive activity - Review admin change logs and restrict administrative access to VPN and firewall management interfaces
Originally reported by cybersecuritynews.com.
