Cybersecurity experts have unveiled a sophisticated intrusion ecosystem powered by artificial intelligence, operated by affiliates of the INC and The Gentlemen ransomware groups.
At the heart of this operation lies an advanced AI-based system known as the "Autonomous Red Team Kill Chain Framework," nicknamed Phantom. The group responsible for these attacks is believed to be Russian-speaking and operates as both an intrusion and data extortion entity, as well as providing infrastructure support to various partners within the ransomware landscape.
According to SOCRadar, the attackers have leveraged a range of edge and remote-access systems on a significant scale, including platforms such as FortiClient EMS, SimpleHelp, cPanel, and various VPN gateways. They have implemented AI-driven knowledge bases to meticulously track victims, manage stolen credentials, and monitor campaign progress.
One striking feature of this campaign is its "AI-executed, human-approved operational framework." In this model, human operators provide prompts tailored to specific victims and oversee each move, while the intrusions are carried out using OpenCode with models hosted on OpenRouter.
Investigations into an exposed directory at 45.227.254[.]43 have revealed logs showing 8,257 messages across 133 sessions. When models hesitate to follow prompts, the operators have been seen rewriting these requests to resemble authorized assessments rather than switching to different models.
Initial access is gained by exploiting public-facing edge devices en masse. Once inside, the attackers perform lateral movement, establish persistence, exfiltrate sensitive data, and prepare for the deployment of ransomware. Their methods have exploited a series of vulnerabilities including:
- CVE-2024-57727 (SimpleHelp path traversal) - actively exploited - CVE-2026-35616 (Fortinet FortiClient authentication bypass) - actively exploited - CVE-2026-41940 (cPanel/WHM authentication bypass) - actively exploited - CVE-2026-15409 (SonicWall SMA 1000 SSRF) - targeted but not confirmed compromised - CVE-2026-63030 (WordPress wp2shell) - under development - CVE-2026-42208 (LiteLLM SQL injection) - in development or referenced - CVE-2026-9082 (Drupal SQL injection) - in development or referenced
Once access is secured, the operators follow a systematic cycle: they enumerate domains, escalate privileges toward domain administrators, capture credentials through specialized tools, focus on financial, human resources, legal, and executive files, and ultimately funnel this data through reverse SOCKS tunnels, as reported by SOCRadar.
Credential reuse has proven to be a significant advantage; in one instance, a single reused password provided access to multiple critical platforms simultaneously, including VPN, servers, remote monitoring management, backups, and security systems. The attackers employed a BYOVD (Bring Your Own Vulnerable Driver) strategy to bypass security products, although their internal logs indicate varied success against enterprise-level endpoint detection and response systems.
Central to the attackers' capabilities is a diverse arsenal of tools, which includes custom frameworks, modified open-source applications, and compiled binaries:
- Phantom, which serves as an AI-enhanced offensive security and penetration testing framework deployed via OpenCode, employs agents that interface with external servers to receive tasks, execute commands, and relay results. Its functionality encompasses 18 skill modules for tasks like reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessments, and EDR footprint identification.
- WormGPT-MCP consists of 32 Model Context Protocol (MCP) servers that connect the AI to various operational modules for functions ranging from reconnaissance to extortion.
- Ghost C2 is a versatile collection of polymorphic implants spanning three generations that communicate with remote servers using Cloudflare, Telegram, or DNS, allowing for task execution and persistent presence on breached networks.
- RevSocks is a reverse SOCKS5 implementation utilized for movement within targeted networks and data staging for exfiltration.
Additional tools include a Cloudflare-protected Mythic agent named QuickLine, a Quick Heal/Seqrite EDR disruptor leveraging the Zemana driver ("zam64.sys") for BYOVD attacks, and data exfiltration utilities such as rks3 and BackupAgent.
Analysis of numerous AI-generated extortion attempts demonstrates that these threat actors take a calculated data-centric approach. They scrutinize stolen financial information to ascertain a victim's ability to pay without involving banks or insurance, subsequently sending masked proof samples and increasing pressure through scripted vishing calls, along with threats to inform customers, partners, and regulators.
If the victim does not comply with payment demands within a critical window of 24-72 hours, the stolen data is then published on designated leak sites. Notably, the outcomes of these ransom negotiations are unclear, as no cryptocurrency wallets or payment records have surfaced.
An estimated 62 organizations have fallen prey to this operation, with four being prominently featured on the data leak sites associated with the INC and The Gentlemen groups. Over half of these targets are located in the U.S., while the primary sectors affected include industrial, manufacturing, and energy, followed by healthcare and pharmaceuticals.
SOCRadar observed that across the exploited infrastructure, these actors systematically targeted vulnerable internet services, specifically focusing on FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls. Simultaneously, they conducted operations through the Phantom framework, set up RevSocks proxies for network pivoting, deployed various Ghost C2 instances, and utilized AI-managed knowledge bases to diligently document victim telemetry, compromised credentials, and the status of ongoing campaigns.
