In the wild
Realized harm
GLOBAL GROUP RaaS advertised AI-driven chatbots to run ransom negotiations for affiliates
AIR-2025-0058 AIR record · 2025-07-eclecticiq-global-group-ai-negotiation
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
features an automated system powered by AI-driven chatbotsblog.eclecticiq.com
The record
Disclosed
2025-07-16
Occurred
2025-06-02
Vendor
criminal operator '$$$'
Product
GLOBAL GROUP ransomware-as-a-service panel
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
Agent acted (contested) — AI chatbots conducted ransom negotiations with victims
Attack surface
Autonomous operations
Autonomy level
Semi-autonomous
Initial vector
Raas platform feature
Impact type
Extortion, Ransomware
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
17 victims claimed by 14 July 2025 across Australian and US healthcare, UK automotive services and industrial firms
Capability abused
Taxonomy & references
Curator notes
impact_realized is true for the ransomware operation (17 named victims), NOT for the AI negotiation feature specifically - the AI-chatbot negotiation capability is advertised on the affiliate panel and described by the operator, and EclecticIQ did not observe a completed AI-run negotiation with a victim. This is the most-cited 'autonomous ransomware negotiation' claim and it rests largely on criminal marketing. Assessed medium confidence as a BlackLock/Mamona rebrand.
Cite as
Enkrypt AI. "GLOBAL GROUP RaaS advertised AI-driven chatbots to run ransom negotiations for affiliates". AIR, AIR-2025-0058. https://agentincident.vercel.app/i/AIR-2025-0058/ (accessed 2026-10-19).