Skip to content
Hacker Posts

INC and Gentlemen affiliates ran AI intrusion framework Phantom

SOCRadar found an exposed server leaking Phantom, an AI 'kill chain' framework INC and The Gentlemen ransomware affiliates used to run human-approved, AI-executed intrusions against 62 orgs.

Published 3 min read
ransomwareai-securityinc-ransomwarethreat-intel

SOCRadar's Threat Research Unit recovered the toolkit of an AI-assisted ransomware operation from an exposed server, and published it October 20 as INC and The Gentlemen Ransomware: Exposed AI Infrastructure; The Hacker News covered it October 23. An open directory on 45.227.254[.]43 exposed the operators' knowledge base, 8,257 messages across 133 OpenCode sessions, and the source of a framework they call Phantom. The operators are affiliates of the INC and The Gentlemen ransomware brands, assessed as Russian-speaking and most active 06:00–14:00 UTC.

How the operation works

Phantom is described as an "Autonomous Red Team Kill Chain Framework" — but the structure SOCRadar documents is AI-executed, human-approved: a human writes a victim-specific prompt and signs off on each step. Intrusions run through OpenCode against OpenRouter-hosted commercial models (the exposed config lists anthropic/claude-opus-4.6 and moonshotai/kimi-k3). When a model refuses a request, the operator reportedly re-frames it as an authorized red-team assessment. Supporting tooling includes WormGPT-MCP (32 MCP servers wiring the model to 32 modules — SOCRadar notes "WormGPT" was a persona prompt, not an uncensored model), the polymorphic Ghost C2, RevSocks for pivoting, and a Zemana-driver (zam64.sys) BYOVD EDR killer.

CVEs in the operators' logs

The exposed knowledge base recorded exploitation of the vulnerabilities below. Per SOCRadar, these are the operators' own records, not independently verified compromises — read them as the crew's claimed toolkit:

The report also references staging against SonicWall SMA 1000 (CVE-2026-15409, which we covered here) with no confirmed compromise, plus development work around Drupal (CVE-2026-9082) and LiteLLM.

Impact

SOCRadar counts 62 named target organizations, 36 of them in the United States, concentrated in industrial, manufacturing and energy (16.1%), then healthcare and pharma (14.5%). The force multiplier was mundane: reused credentials. In one case a single reused password reportedly unlocked the VPN, servers, RMM, backup and security-management platforms. Extortion is data-centric — financials analyzed to set a payable demand, masked proof samples, scripted vishing, publication after a 24–72 hour deadline. No wallet or payment record was recovered, so monetization outcomes are unknown.

Action checklist

  1. Patch the four CVEs above if you run SimpleHelp, FortiClient EMS, cPanel/WHM or Roundcube — all are real, and several are independently known-exploited regardless of this crew.
  2. Kill credential reuse across tiers. The single-password-unlocks-everything path is what turned one foothold into full compromise. Separate VPN, RMM, backup and EDR-console credentials; enforce phishing-resistant MFA on each.
  3. Block BYOVD. Add zam64.sys (Zemana) to your vulnerable-driver blocklist; enable Microsoft's driver blocklist / HVCI where you can.
  4. Alert on RMM you didn't install — the operators lean on legitimate remote-access tooling for persistence.

Context

This is the third AI-tooled intrusion ecosystem we've logged this quarter, alongside the LiteLLM supply-chain compromise and the SonicWall SMA staging above. The pattern is consistent and worth stating plainly: the models here are not autonomously breaching anyone — a human still drives and approves. What the AI layer buys the crew is scale and speed across 62 targets with a small team. Defenders get a small gift in return: operators who leave an OpenCode knowledge base world-readable hand investigators the whole playbook.

Related stories