Extortion crews have their eyes on high-value AI data, Google warns

Google Threat Intelligence team warned that ransomware gangs are attacking high-value artificial intelligence data. In two cases investigated by Mandiant, attackers infiltrated medical companies and an AI media generation company, stealing sensitive data including AI models, source code, and prompts, and threatening to reveal the information without payment of a ransom. These incidents have affected the technology, medical, and media industries in North America and Europe. Additionally, the gang named TeamPCP (UNC6780) has carried out multiple large-scale open-source supply chain attacks since March, using malicious GitHub Actions workflows to steal AI repositories. Analysts noted that companies are often forced to pay ransoms due to their reluctance to expose intellectual property. At the same time, attackers are integrating proxy AI capabilities throughout the entire attack process, such as autonomously completing vulnerability scanning and credential collection within six hours, and even using Gemini to design automated penetration testing frameworks.