SOCRadar uncovers AI intrusion framework tied to ransomware affiliates

SOCRadar’s Threat Research Unit uncovered an AI-driven intrusion ecosystem run by affiliates of INC and The Gentlemen ransomware groups, centered on the Phantom Autonomous Red Team Kill Chain Framework, with activity from mid-July 2026 to live encryption on September 30, 2026.

SOCRadar said the exposed command-and-control server at 45.227.254[.]43 exposed AI session databases, a knowledge base, and Phantom source code, leading to six more adversary servers, most hosted on AS267784 Flyservers S.A. The campaign surfaced in late September 2026 after OPSEC failures exposed source code, credentials, and AI session logs. SOCRadar said the knowledge bases and session logs form a complete evidence trail of the campaign.

SOCRadar said Phantom is a modular Autonomous Red Team Kill Chain Framework deployed in live intrusion operations. Its agents disguise themselves as Windows Update components and call back to an external server to retrieve tasks and return outputs. The framework supports 18 skill modules covering reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting.

SOCRadar said intrusions run through OpenCode with OpenRouter-hosted commercial models, producing 8,257 messages across 133 sessions. Recorded AI API spending exceeds $23,920 across two active paid OpenRouter accounts checked on October 5, 2026. Operations use an AI-executed, human-approved structure in which a human sends a victim-specific prompt and approves every step.

SOCRadar said when models refused prompts, the operator rewrote requests as Authorized Red Team Assessment Request templates instead of switching models. Operators were most active between 06:00 and 14:00 UTC and used AI for stealth decisions, tool debugging, and OPSEC. WormGPT-MCP comprises 32 Model Context Protocol servers linking the AI to modules spanning reconnaissance to extortion.

SOCRadar said initial access came from exploiting public-facing edge devices at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways. Operator records show active exploitation of CVE-2024-57727 SimpleHelp path traversal, CVE-2026-35616 FortiClient authentication bypass, and CVE-2026-41940 cPanel WHM authentication bypass. SimpleHelp scans of 4,922 servers yielded 427 admin passwords affecting 242 unique IP addresses. SOCRadar said, “The operators exploited edge and remote-access systems at scale.”

SOCRadar said FortiClient EMS records list 2,236 targets, 108 created admin accounts, and 4,140 managed endpoints. cPanel records claim 49 or more breaches of small hosting providers used to reach hosted e-mail and webmail servers. Ivanti, Citrix, SonicWall, and OpenVPN gateways were also evaluated, with three recorded compromises.

SOCRadar said operators staged CVE-2026-15409 SonicWall SMA 1000 SSRF for targeting with no confirmed compromise. Operators developed or referenced CVE-2026-63030 WordPress wp2shell, CVE-2026-42208 LiteLLM SQL injection, and CVE-2026-9082 Drupal SQL injection.

SOCRadar said once inside, operators enumerated domains, escalated to domain admin, harvested credentials, and prioritized finance, HR, legal, and executive files. Operators collected stolen data over reverse-SOCKS tunnels using the RevSocks pivoting framework. Credential reuse was the main force multiplier, with one reused password unlocking VPN, servers, RMM, backup, and security management platforms.

SOCRadar said security products were impaired with a BYOVD killer and loader-level evasion, though logs show mixed results against enterprise EDRs. A Quick Heal/Seqrite EDR killer abuses the Zemana driver zam64.sys as part of a BYOVD attack. Ghost C2 uses three generations of polymorphic implants communicating over Cloudflare, Telegram, or DNS.

SOCRadar said supporting tools include a Cloudflare-fronted Mythic agent called QuickLine and exfiltration tools named rks3 and BackupAgent. A phishing delivery service used malicious Word templates and HTML smuggling with a scheduled task named RealtekAudioSvc, recorded only as an internal self-test.

SOCRadar said INC Ransomware is a Rust-based ransomware-as-a-service tracked since August 2023 under G1032. The Windows encryptor stops backup and database processes and deletes shadow copies through direct driver calls. It appends the .INC extension and drops INC-README.txt notes pointing victims to a Tor chat portal.

SOCRadar said forty-six custom INC encryptor builds were prepared for six victims for an October 1, 2026 deployment wave, though deployment against the six staged targets remains unconfirmed. Three per-victim encryptor packages were packed on September 30, 2026, and crew chat referenced deployment timing. A SimpleHelp screenshot from September 30, 2026 shows the encryptor running on a victim workstation. Payment was planned in Monero, but no cryptocurrency wallet or payment record was recovered.

SOCRadar’s researchers estimate the campaign targeted 62 organizations, with 36 located in the United States. The United States accounts for more than 50% of the targets. Industrial, manufacturing, and energy organizations lead targeting, followed by healthcare and pharmaceutical organizations.

SOCRadar said industrial manufacturing and energy organizations account for 16.1% of targets, followed by healthcare and pharma at 14.5%. Among 35 classifiable targets, 27 had revenues of $250M or less and 8 exceeded $250M. Operators reached small businesses through a managed service provider, while operators compromised larger organizations through independent vectors.

SOCRadar’s STRU graded 62 organizations: four publicly listed for extortion, four at encryption or extortion, and 14 with domain-level compromise. Another 28 organizations had a foothold or access, while 12 were at reconnaissance only. Four organizations reached public extortion listings on INC and The Gentlemen leak sites.

SOCRadar said AI-authored extortion records use a data-centric playbook estimating what a victim can pay from stolen financials before sending masked proof samples. Pressure escalates through scripted vishing calls and threats to notify customers, partners, and regulators, with deadlines of 24 to 72 hours.

SOCRadar said the Aidon case involved an EUR 15M demand cut to EUR 4M/2.5M after the operator targeted the wrong parent company. Leo Schachter Diamonds received a four-message extortion set signed The Gentlemen with a vishing plan and appears on that group’s leak blog.

Trulite Glass & Aluminum Solutions faced a look-alike site trulitesupport[.]com. A healthcare network case carried a 24-hour deadline with an AUD 3M to 8M price band. Aidon, Trulite, and City of Princeton, TX match INC leak site victims in internal case files.

SOCRadar’s STRU assesses confidence in a formal dual-brand alliance between INC and The Gentlemen as low, with moderate-to-high confidence in a shared operational environment. Operators used FOFA API accounts tied to smilefacesec[@]gmail[.]com for scanning, and that address registered a BreachForums account under sm4l1st123. A partner onboarding guide README_PARTNER.md on 45.227.254[.]45 advertised 35 MCP servers, 55+ tools, and 9K+ CVE PoC.