Phantom, the autonomous AI framework that drove INC and The Gentlemen ransomware intrusions

In late September 2026, SOCRadar found an exposed C2 server laying bare the AI-driven intrusion ecosystem of INC Ransomware and The Gentlemen affiliates: 8,257 agent messages, 62 named organizations, and the source code of an autonomous kill-chain framework called Phantom. For defenders, the lesson is not “AI attacks” — it is that AI session logs are now exploitable forensic evidence.