Thehackernews AI-Driven Ransomware Ecosystem Exposed by Security Researchers
Article Content
- •AI-driven ransomware operation linked to INC and The Gentlemen groups.
- •Exploited vulnerabilities include CVE-2026-35616, CVE-2024-57727, and CVE-2026-41940.
- •Over $23,920 spent on AI services for orchestrating attacks on 62 organizations.
Cybersecurity researchers have uncovered an AI-assisted ransomware operation linked to the INC and The Gentlemen groups. The exposed infrastructure includes seven servers used for orchestrating attacks on 62 organizations, with over $23,920 spent on AI services. The operation employs an 'Autonomous Red Team Kill Chain Framework' named Phantom, which utilizes AI for planning and executing intrusions, requiring human approval at each step. Key vulnerabilities exploited include CVE-2026-35616 (FortiClient authentication bypass), CVE-2024-57727 (SimpleHelp path traversal), and CVE-2026-41940 (cPanel/WHM authentication bypass), all of which are actively exploited. The attackers have logged 8,257 messages across 133 sessions, indicating a high level of operational sophistication. The investigation began after operator OPSEC failures led to the exposure of these servers. Security experts recommend patching the affected systems and monitoring for unauthorized access.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track INC, Ghost C2 and Citrix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What systems are affected?
How urgent is this threat?
What actions should we take?
Continue Reading
Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure… 
Ransomware Groups Exploit Palo Alto VPN Flaw CVE-2026-0257 Ransomware groups Qilin and INC are exploiting CVE-2026-0257, a vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN, to bypass authentication and gain unauthorized access to corporate networks. Despite a security patch released in May 2026, attackers have been exploiting this flaw since June, allowing them…