Ransomware affiliates used AI agents to run 62 intrusions

SOCRadar reported finding an AI-run intrusion operation linked to affiliates of the INC and The Gentlemen ransomware families, according to LavX News and The Hacker News. Phantom, an autonomous red-team framework, was central to the operation; it performs intrusions with commercial AI models, but a human operator approves every step. SOCRadar identified the actor as Russian-speaking and as someone who runs intrusions and also supplies infrastructure to other ransomware partners.

The exposed server at 45.227.254.43 contained 8,257 messages in 133 sessions. The logs show an AI-executed, human-approved setup: a person gives a prompt tailored to the victim, checks each action, and allows the AI to run commands via OpenCode using commercial models hosted on OpenRouter. If models refused a request, the operator rephrased it as an authorized red-team assessment instead of changing models.

Initial entry came from exploiting exposed edge devices at scale, such as FortiClient EMS, SimpleHelp, cPanel and VPN gateways. SOCRadar said active exploitation targeted CVE-2024-57727, a SimpleHelp path traversal, CVE-2026-35616, a Fortinet FortiClient authentication bypass, and CVE-2026-41940, a cPanel/WHM authentication bypass. The group staged CVE-2026-15409, a SonicWall SMA 1000 SSRF, and built exploits for CVE-2026-63030 in WordPress wp2shell, CVE-2026-42208, a LiteLLM SQL injection, and CVE-2026-9082, a Drupal SQL injection.

After gaining access, SOCRadar said the attackers repeated a set sequence: map the domain, try to gain domain admin, run credential stealers, focus on files from finance, HR, legal and executive teams, and then move data out through reverse-SOCKS tunnels. SOCRadar described credential reuse as the main force multiplier. In one example, a reused password opened access to the VPN, servers, remote monitoring and management, backup and security management systems at the same time. A BYOVD killer and loader-level evasion impaired security products, though operator logs recorded mixed outcomes against enterprise EDRs.

Phantom has 18 skill modules covering reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment and EDR fingerprinting. A component called WormGPT-MCP linked the AI to 32 Model Context Protocol servers handling tasks from reconnaissance to extortion. Ghost C2 used three generations of polymorphic implants that communicate over Cloudflare, Telegram, or DNS. RevSocks provided reverse SOCKS5 pivoting inside victim networks. Additional tools were QuickLine, a Mythic agent fronted by Cloudflare; a Quick Heal/Seqrite EDR killer that misuses the Zemana driver zam64.sys in a BYOVD attack; and data-exfiltration utilities named rks3 and BackupAgent.

The actors used data-centric extortion. They examined stolen financial records to determine how much a victim could pay without involving a bank or insurer, sent masked proof samples, and raised pressure through scripted vishing calls and threats to notify customers, partners, and regulators. Victims faced a 24 to 72 hour deadline before data appeared on the INC and The Gentlemen leak sites. SOCRadar estimated the operation targeted 62 organizations, four of which appeared on the leak sites. More than 50% of targets were in the United States. Most attacks hit industrial, manufacturing and energy organizations, with healthcare and pharmaceutical firms next. No cryptocurrency wallet or payment record was recovered, so the final ransom outcomes are unknown.

SOCRadar's defensive guidance included patching exposed edge devices right away, checking for reused credentials on VPN and management platforms, and watching for BYOVD drivers like zam64.sys. Because the campaign mixes AI automation with human approval, defenders need detection for both the technical traces and the prompt patterns that drive the framework.