EXPOSED SERVERS REVEAL AN AI

X • October 21, 2026

🚨 EXPOSED SERVERS REVEAL AN AI-ASSISTED RANSOMWARE WORKBENCH TIED TO INC AND THE GENTLEMEN

A threat research report published Oct 20, 2026 describes seven exposed adversary servers used by affiliates of the INC and The Gentlemen ransomware operations, with 62 targeted organizations and more than $23,920 spent on commercial AI services. The investigation began in late September, after operator OPSEC failures left the servers' open directories exposed.

• OpenCode AI session logs (8,257 messages across 133 sessions) using commercial models: the AI planned recon, generated commands and triaged stolen data, but waited for the human operator's approval before every step

• Source code for "Phantom", an autonomous red-team framework with 18 skill modules, alongside Ghost C2, RevSocks, MCP servers and exfiltration tools; plus extortion procedures and scripted vishing

• 46 custom INC encryptor builds for six victims, packed on Sep 30 for a planned Oct 1 deployment wave

• A Sep 30 screenshot showing the encryptor running on one victim workstation

• Operator records of mass exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940); those counts are the operators' own and not independently verified

This is firsthand research from the team that found the servers, not independent validation. The researchers link the workbench to both INC and The Gentlemen operations but rate a formal alliance as low confidence; a shared tooling environment used by several partners is the more likely model. Staged builds do not prove deployment: the planned Oct 1 encryption wave is unconfirmed beyond the one workstation screenshot. The report grades organizations by depth of activity, including reconnaissance-only targets; DDW does not name them, and none should be read as a confirmed breach. Defenders: patch FortiClient EMS, SimpleHelp and cPanel/WHM, check EMS for unauthorized admin accounts, and lock down RMM tools.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Ransomware Ecosystem Exposed by Security Researchers Cybersecurity researchers have uncovered an AI-assisted ransomware operation linked to the INC and The Gentlemen groups. The exposed infrastructure includes seven servers used for orchestrating attacks on 62 organizations, with over $23,920 spent on AI services. The operation employs an 'Autonomous Red Team Kill Chain Framework' named Phantom, which utilizes AI for planning and executing intrusions, requiring human approval at each step. Key vulnerabilities exploited include CVE-2026-35616 (FortiClient authentication bypass), CVE-2024-57727 (SimpleHelp path traversal), and CVE-2026-41940 (cPanel/WHM authentication bypass), all of which are actively exploited. The attackers have logged 8,257 messages across 133 sessions, indicating a high level of operational sophistication. The investigation began after operator OPSEC failures led to the exposure of these servers. Security experts recommend patching the affected systems and monitoring for unauthorized access. 2 sources 75

Extracted Entities

EXPOSED SERVERS REVEAL AN AI

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

Malware (1)

MITRE ATT&CK (2)

Platforms (4)

Ransomware Groups (2)

Tools (4)