SesameOp Hides Inside OpenAI Traffic While The Gentlemen Shake Down Healthcare
A backdoor that tunnels through OpenAI's own API. A ransomware crew that hit a major health-tech firm via stolen vendor credentials. Two cases, one playbook.
Key points
- Microsoft's Detection and Response Team discovered SesameOp, a backdoor that hides its control traffic inside OpenAI's Assistants API, making malicious commands look like routine AI development work.
- Healthcare technology company Veradigm filed an SEC disclosure on September 8, 2026, confirming attackers used a third-party vendor's stolen credentials to access patient data, including Social Security numbers in some cases.
- The Gentlemen ransomware group claimed responsibility for the Veradigm breach and threatened to publish the stolen data.
- Veradigm said neither clinical nor medical data was exposed and that only a small number of customers were affected.
- Security researchers describe a broad shift toward "living off the cloud," where criminals route attacks through legitimate platforms rather than building their own infrastructure.
Picture a burglar who, instead of picking your lock, borrows a key from a trusted delivery courier. That's the rough shape of what researchers are calling "living off the cloud," and two incidents show how far the technique has matured.
What is SesameOp and why does it matter?
SesameOp is a backdoor: hidden software that lets attackers send commands to a machine they've already broken into. What makes it unusual is where those commands travel, straight through OpenAI's Assistants API.
The OpenAI Assistants API is a service developers use to build AI-powered tools and chatbots. SesameOp borrows that same channel to receive instructions, so to a company's network monitors the traffic looks like a developer testing a product, not a criminal issuing orders. Parthiban Jegatheesan, managing director at Peneto Labs, told CSO Online that the traffic "blends in with legitimate business use, making it much harder to block without breaking real workflows."
Microsoft's incident response team named and detailed the backdoor in a November 2025 advisory, noting discovery in July 2025 during a response to a breach where criminals had been quietly present for months. Once inside, they planted web shells (small programs hidden on a web server that accept remote commands) and corrupted several Microsoft Visual Studio developer tools with malicious code.
This isn't SQL injection with extra steps. The API-as-relay trick is genuinely clever, because blocking OpenAI traffic would break legitimate work for thousands of companies. We looked at a related case in our 29 September story on Storm-3068, where Microsoft's incident response team traced how a single user account became the door into Azure DevOps and Kubernetes clusters without any malware deployed at all.
What happened at Veradigm, and who are The Gentlemen?
Veradigm, a healthcare technology firm, disclosed the incident to the SEC on September 8, 2026. Attackers used stolen credentials belonging to a third-party vendor to reach patient records, including Social Security numbers in some cases. Veradigm said neither clinical nor medical data was exposed and that only a small number of customers were affected.
The Gentlemen ransomware group, which encrypts victims' files and threatens to publish stolen data unless a ransom is paid, claimed responsibility. Ronald Lewis, head of cybersecurity governance at Black Duck, told CSO Online that the attackers "didn't compromise server resources but rather exploited a trusted identity with a path to sensitive data."
When we first reported the Veradigm breach on 17 September 2026, The Gentlemen were claiming millions of patient records. The group has since listed further victims: we covered their claims against FTAPI Software on 28 September and Gerrity Stone on 4 October. All such claims are unverified.
The Veradigm case makes the wider pattern concrete: no custom malware, no server broken into. A valid login, pointed at the right interface, was enough.
| Event | Date | Detail |
|---|---|---|
| SesameOp discovered | July 2025 | Microsoft DART, during active incident response |
| Microsoft advisory published | November 3, 2025 | Named and detailed SesameOp backdoor |
| Veradigm SEC filing | September 8, 2026 | Patient data accessed via vendor credentials |
| The Gentlemen claimed responsibility | September 2026 | Threatened to release stolen data |
Should ordinary people worry about this?
If you're a patient of any healthcare provider, breaches involving Social Security numbers carry long-tail risk: identity theft can surface months or years after the event. If Veradigm contacts you with a breach notice, read it carefully and consider placing a free credit freeze with the major credit bureaus.
For everyone else, the practical point is that blocklists and reputation filters are getting less reliable as criminals route through OpenAI, Google Sheets, SharePoint and Slack rather than their own suspicious servers. The defences that stop these attacks sit deeper: monitoring for unusual behaviour patterns rather than known-bad addresses. That's a job for IT teams, not individuals, but it explains why incidents like these keep succeeding even at organisations with real security budgets.
The SesameOp technique is the more interesting long-term story. Routing command-and-control through a paid AI API is a genuine evolution. The Veradigm case shows The Gentlemen are happy to combine old-fashioned credential theft with data-exposure threats to squeeze victims. Neither trick is new in isolation. Together, wrapped inside legitimate cloud infrastructure, they're increasingly hard to catch.
Common questions
How do criminals get the initial access they need to pull off these attacks?
Most entry points are credential theft: stolen passwords bought from other criminals, phishing emails that trick an employee into handing over a login, or a third-party vendor whose security is weaker than the target's own. Once a valid login exists, cloud systems often can't tell the criminal from a real employee.
Can security software detect a backdoor hiding inside OpenAI traffic?
Not easily with traditional tools. Defenders need to look at behaviour rather than destination: an internal server that suddenly starts making repeated calls to an AI API it has never used before is a signal worth investigating, even if the destination is entirely legitimate.
