Ransomware affiliates spent $23,900 on commercial LLM APIs for intrusions

**Summary**

Ransomware affiliates have reportedly spent approximately $23,900 on commercial LLM APIs to support intrusion operations, according to posts circulating on Reddit. The key detail users are highlighting is that these actors used standard, commercially available language models rather than specialized "dark" or jailbroken alternatives—instead relying on prompt rewriting techniques to achieve their objectives.

**Dominant framing**

The framing centers on accessibility and ordinariness: ransomware operators are not using exotic tools or underground AI models, but rather legitimate commercial services with modified prompts. This suggests a relatively low barrier to entry for incorporating LLM capabilities into criminal operations. The modest dollar amount ($23,900) is being presented as evidence that this capability is economically feasible for threat actors.

**Notable gaps**

Engagement on this topic is minimal—only two Reddit posts with minimal comments and no mainstream media coverage. The source of the $23,900 figure and the methodology behind it are not detailed in the available posts, leaving questions about the scope, timeframe, and verification of this claim unanswered. Without additional reporting or context, it remains unclear whether this represents a comprehensive study, a single case, or an estimate.