Phantom, the autonomous AI framework that drove INC and The Gentlemen ransomware intrusions
In late September 2026, SOCRadar found an exposed C2 server laying bare the AI-driven intrusion ecosystem of INC Ransomware and The Gentlemen affiliates: 8,257 agent messages, 62 named organizations, and the source code of an autonomous kill-chain framework called Phantom. For defenders, the lesson is not “AI attacks” — it is that AI session logs are now exploitable forensic evidence.
Mid-July 2026. The Ghost C2 that anchors the operation goes live. September 30, 2026. A SimpleHelp screenshot shows live encryption on a victim workstation. October 20, 2026. SOCRadar publishes its full analysis of an AI-driven intrusion ecosystem. The point: this is not “AI attacking on its own” — it is a human-in-the-loop arrangement where the AI plans, generates and triages, and an operator approves every step.
How the infrastructure was found
The SOCRadar Threat Research Unit (STRU) investigation began with a publicly exposed command-and-control server at 45.227.254.43. Its open directories held the operators’ knowledge base, their AI session logs, and the source code of Phantom, described as an “Autonomous Red Team Kill Chain Framework.” Config files, logs and credentials on that first host led to six more adversary-controlled servers, mostly hosted on AS267784 (Flyservers S.A.).
The actors are affiliates of INC Ransomware (MITRE group G1032, also tracked as GOLD IONIC) and The Gentlemen Ransomware. The servers held 46 INC encryptor builds prepared for six victims and staged for an October 1, 2026 deployment, evidence of live encryption, and a branded extortion package for The Gentlemen.
What took the operation down was not exotic sophistication. It was an OPSEC failure: the operators left their own logs, knowledge base and AI sessions open. The system’s memory was, literally, readable by anyone.
AI as co-operator, human as approver
STRU analyzed 8,257 messages across 133 OpenCode sessions, alongside three iterations of the knowledge base. The pattern that emerges is clear: an “AI-executed, human-approved” structure.
The stack is ordinary, and that is the point. The interface is OpenCode; the models are standard commercial LLMs served through OpenRouter — anthropic/claude-opus-4.6 and moonshotai/kimi-k3 appear in the logs. “WormGPT” was only a persona prompt layered on those models, not an uncensored model. When a model refused, the operator did not switch models: they rewrote the request as an “Authorized Red Team Assessment Request” template instead.
Each campaign started with a victim-specific master prompt, and the AI waited for operator approval before every step, under the instruction “coordinate every action with me.” The operators — Russian-speaking and most active between 06:00 and 14:00 UTC — used the AI for reconnaissance, technique selection, command generation, triage of stolen data and report drafting.
The cost is quantified. A live check on October 5, 2026 found two paid OpenRouter accounts, one nearly exhausted after $23,920 in API spending. The AI is no longer an attacker’s gimmick: it is a line item in a ransomware operation.
Initial access through edge appliances
The front door was not clever phishing but exposed edge devices, exploited at scale. The operators’ records — not independently verified, but internally consistent — give the orders of magnitude:
- CVE-2026-35616, a FortiClient EMS authentication bypass: 2,236 targets, 108 admin accounts created and 4,140 endpoints managed, with backdoors planted in modified VPN scripts.
- CVE-2024-57727, a SimpleHelp path traversal: scans of 4,922 servers, 427 admin passwords recovered and 242 unique IP addresses hit — stolen MSP technician credentials opening access to every client those technicians managed.
- CVE-2026-41940, a cPanel/WHM authentication bypass: 49 claimed breaches at small hosting providers, used as a springboard to the email servers they host.
This mechanic echoes FortiBleed, which we covered here. The difference is an AI layer stacked on top of the same edge-appliance entry engine.
In total, 62 organizations are named in the records, 36 in the United States, led by industrial and manufacturing (16.1%) then healthcare (14.5%). Four victims reached public extortion listings, and 14 suffered domain-level compromise.
What it changes for defenders
For a CISO, three concrete lessons fall out.
First, the AI did not change the front door — it industrialized everything after it. The same edge CVEs, the same stolen credentials. So the core fix remains the most basic one: patch FortiClient EMS, SimpleHelp and cPanel, hunt for rogue EMS admins and modified VPN on_connect scripts, rotate credentials and enforce MFA on remote-access tooling.
Second, the AI leaves a richer trail than a human does. The knowledge bases and session logs are a complete investigation thread — a gift for attribution, but also a reminder that our own internal AI tools accumulate the same kind of logs, which deserve the same protection as secrets.
Third, the safety rails of commercial models are bypassed by language. If your controls assume an LLM will refuse to help an attacker, this case shows the opposite: reframing as “authorized red team” is often enough. Defense has to target the actions, not the model’s stated intent.
Verdict
If you expose edge appliances — EMS, RMM, hosting panels — treat them as the first line. Patching FortiClient EMS, SimpleHelp and cPanel closes the door these affiliates actually used, and hunting planted admins and modified VPN scripts finds those already inside. If you deploy AI agents internally, draw the inverse lesson from the attack: log and protect sessions as a sensitive surface, because it was exactly that memory that brought down INC and The Gentlemen — do not let it bring down yours.