SOCRadar researchers discovered an AI-driven intrusion ecosystem tied to affiliates of the INC and The Gentlemen ransomware groups. The operation used the Phantom framework, commercial AI models, and exposed infrastructure at 45.227.254[.]43 to execute attacks across 62 organizations.
SOCRadar researchers discovered an AI-driven intrusion ecosystem tied to affiliates of the INC and The Gentlemen ransomware groups. The operation centers on Phantom, an autonomous red-team framework that executes intrusions through commercial AI models while a human operator approves each step.
The threat actor, assessed as Russian-speaking, functions as both an intrusion operator and an infrastructure provider for partners across the ransomware ecosystem. Investigators found exposed infrastructure at 45.227.254[.]43 holding 8,257 messages across 133 sessions. The records reveal an AI-executed, human-approved structure: the operator feeds a victim-specific prompt to the model, reviews every step, and lets the AI execute commands through OpenCode with OpenRouter-hosted commercial models.
Models refused to act at times, so the operator rewrote requests as authorized red-team assessments rather than switching models. Attackers gained initial access by exploiting public-facing edge devices at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways.
Once inside, attackers moved laterally, established persistence, exfiltrated data, and escalated toward ransomware deployment. They followed a recurring lifecycle: enumerate the domain, escalate to domain admin where possible, harvest credentials with stealer tooling, prioritize finance, HR, legal, and executive files, and collect them over reverse-SOCKS tunnels, SOCRadar said.
The operation exploits multiple vulnerabilities. Active exploitation targets CVE-2024-57727 (SimpleHelp path traversal), CVE-2026-35616 (Fortinet FortiClient authentication bypass), and CVE-2026-41940 (cPanel/WHM authentication bypass). Staged targets include CVE-2026-15409 (SonicWall SMA 1000 SSRF). Developers have built exploits for CVE-2026-63030 (WordPress wp2shell), CVE-2026-42208 (LiteLLM SQL injection), and CVE-2026-9082 (Drupal SQL injection).
Credential reuse served as the primary force multiplier. In one case, a single reused password unlocked the VPN, servers, remote monitoring and management platforms, backups, and security management tools at once. Security products faced impairment from a BYOVD killer and loader-level evasion, though operator logs record mixed results against enterprise endpoint detection and response systems.
The toolkit blends bespoke frameworks, modified open-source tools, and compiled binaries. Phantom, an AI-powered offensive security framework, deploys live via OpenCode. Its agent communicates with an external server to retrieve tasks, execute commands, and return outputs. It supports 18 skill modules for reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting.
WormGPT-MCP connects the AI system to 32 Model Context Protocol servers spanning reconnaissance to extortion. Ghost C2 uses three generations of polymorphic implants that communicate over Cloudflare, Telegram, or DNS, maintaining persistent beacons. RevSocks provides reverse SOCKS5 pivoting inside victim networks.
Other tools include QuickLine, a Cloudflare-fronted Mythic agent; a Quick Heal/Seqrite EDR killer that abuses the Zemana driver (zam64.sys) in a BYOVD attack; and exfiltration programs such as rks3 and BackupAgent.
The actors adopt a data-centric extortion approach. They examine stolen financial records to determine how much a victim can pay without involving a bank or insurer. They send masked proof samples, then ramp up pressure through scripted vishing calls and threats to notify customers, partners, and regulators. Victims face a 24-72 hour deadline before data appears on the INC and The Gentlemen leak sites.
Researchers estimate the operation targeted 62 organizations. Four appeared on the ransomware groups' data leak sites. The U.S. accounts for more than 50% of targets. Industrial, manufacturing, and energy sectors faced the bulk of attacks, followed by healthcare and pharmaceutical organizations. Investigators have not recovered any cryptocurrency wallet or payment record, so the final outcomes of the ransom demands remain unknown.
Across the exposed infrastructure, the actors exploited FortiClient EMS gateways, Ivanti, Citrix, SonicWall, and OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls. They orchestrated operations through Phantom, established RevSocks proxies, deployed Ghost C2 variants, and used AI-managed knowledge bases to log victim telemetry, compromised credentials, and campaign status.
Defenders should patch exposed edge devices immediately, audit credential reuse across VPN and management platforms, and monitor for BYOVD drivers such as zam64.sys. The blend of AI automation and human approval demands detection coverage for both technical footprints and the prompt patterns feeding the framework.
Source : thehackernews.com
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
