Loading threat actor…
Trim is a Russian-speaking cybercriminal actor associated with the offensive abuse of frontier AI models and the commercialization of AI-assisted intrusion tooling. The actor emerged on a Russian-language cybercrime forum in 2026, initially sharing detailed jailbreaking methods for bypassing safety controls in Anthropic Claude Opus and related models, then rapidly evolving that work into a marketed automated platform called AI Pentest Checker. Trim’s reported tradecraft centers on prompt-based jailbreaking rather than exploitation of underlying AI infrastructure. Documented methods include establishing benign context before introducing malicious requests, reframing tasks to focus on code structure rather than intent, restarting conversations after refusals and resubmitting softened prompts, switching among models with different guardrails, using locally hosted uncensored models, and obtaining gray-market access to commercial AI services. This activity reflects deliberate defense-evasion against model safety mechanisms and operational adaptation when providers block abusive requests. AI Pentest Checker was promoted as an automated web vulnerability assessment platform that combines jailbroken AI assistance with established offensive security tools. Reported functionality includes target discovery, reconnaissance, endpoint enumeration, secret detection, vulnerability validation, critical finding escalation, and automated exploitation-style report generation. The platform was described as integrating multiple scanning utilities and AI models to compress multi-step intrusion support workflows into a short, highly automated process, lowering the expertise and time required to coordinate offensive operations. Trim is notable less for bespoke malware than for operationalizing AI as an orchestration layer for cybercrime. The actor’s activity demonstrates how publicly accessible large language models can be repurposed to support reconnaissance, scanning, intrusion preparation, and post-scan analysis when safety controls are bypassed. Available reporting supports characterization of Trim as a financially motivated cybercriminal actor operating from the Russian-speaking underground ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercriminal actor evolving from sharing AI jailbreaking guidance to commercializing an automated offensive web vulnerability scanning platform called AI Pentest Checker, using frontier AI models and multiple scanning tools to assess target domains and generate exploitation reports.
Promoted and reportedly built AI Pentest Checker, an automated penetration testing platform that combines jailbroken AI models with legitimate offensive security tools to accelerate reconnaissance, vulnerability validation, and report generation.
Promoted and allegedly built AI Pentest Checker, an automated penetration testing platform that combines jailbroken AI models with legitimate security tools to automate reconnaissance, vulnerability validation, result interpretation, and report generation.
Developed and commercialized AI-assisted offensive security tooling by jailbreaking frontier AI models, using leaked system-prompt knowledge, and packaging the capability into an automated web vulnerability scanning and penetration-testing platform marketed on a Russian-language cybercrime forum.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.