An exposed infrastructure directory has revealed how ransomware affiliates used AI tools to execute intrusions under human supervision, from exploiting internet-facing services to organizing stolen data and preparing extortion demands.
According to SOCRadar findings reported by The Hacker News, the operation involved affiliates of INC and The Gentlemen ransomware groups. Researchers assessed the operator as Russian-speaking and described a dual role: conducting intrusions and data extortion while supplying infrastructure to partners across the ransomware ecosystem.
SOCRadar estimated that 62 organizations were targeted. Four subsequently appeared on the leak sites of INC and The Gentlemen, but those listings do not independently establish the extent of any theft. More than 50% of the targets were in the United States. Industrial, manufacturing and energy organizations predominated, followed by healthcare and pharmaceutical organizations.
Human approval, AI execution
At the center of the operation was Phantom, described as an “Autonomous Red Team Kill Chain Framework.” Despite that name, the observed workflow relied on human oversight: an operator supplied a victim-specific prompt and reviewed each step, while OpenCode executed intrusion tasks using commercial models hosted through OpenRouter.
The exposed directory contained 8,257 messages across 133 sessions. When models refused requests, the operator reframed them as authorized red team assessments rather than simply changing models, according to the report. AI-managed knowledge bases tracked victims, compromised credentials and campaign progress.
Phantom supported 18 skill modules covering activities including reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment and EDR fingerprinting. Its agent retrieved tasks from an external server, executed commands and returned results.
Edge exploitation followed by credential reuse
Operator records distinguished vulnerabilities used for access from capabilities still being prepared. They recorded active exploitation of SimpleHelp path traversal vulnerability CVE-2024-57727, FortiClient EMS vulnerability CVE-2026-35616, and cPanel/WHM authentication bypass CVE-2026-41940.
The SimpleHelp flaw allows unauthenticated attackers to download arbitrary files through crafted HTTP requests, potentially exposing configuration secrets and hashed passwords. For FortiClient EMS, the Fortinet-supplied CVE record identifies versions 7.4.5 through 7.4.6 as affected by improper access control that may permit unauthenticated execution of unauthorized code or commands.
Other entries did not establish successful exploitation in this operation. SonicWall SMA 1000 SSRF vulnerability CVE-2026-15409 was staged for targeting, with no confirmed compromise. The records described WordPress “wp2shell,” CVE-2026-63030, as developed, while LiteLLM SQL injection CVE-2026-42208 and Drupal SQL injection CVE-2026-9082 were developed or referenced.
After gaining access, the operators enumerated domains, sought domain administrator privileges, harvested credentials with stealer tools and established persistence. They prioritized finance, HR, legal and executive files, collecting data over reverse-SOCKS tunnels before escalating toward ransomware deployment.
Credential reuse substantially widened access. In one documented case, a single reused password opened the VPN, servers, remote monitoring and management tools, backup systems and security management platforms, SOCRadar said.
Implants, tunnels and security-tool interference
The supporting toolkit included WormGPT-MCP, a set of 32 Model Context Protocol servers connecting the AI system to 32 modules spanning reconnaissance through extortion. Ghost C2 comprised three generations of polymorphic implants that used Cloudflare, Telegram or DNS to communicate with remote infrastructure, receive tasks and maintain persistent beacons.
RevSocks supplied reverse SOCKS5 tunnels for internal movement and staging data for exfiltration. Other components included the Cloudflare-fronted Mythic agent QuickLine and exfiltration programs rks3 and BackupAgent.
The operators also attempted to impair endpoint protection through loader-level evasion and a Quick Heal/Seqrite EDR killer that abused the Zemana driver zam64.sys in a bring-your-own-vulnerable-driver attack. Their own logs recorded mixed results against enterprise EDR products.
Financial analysis shaped extortion demands
Dozens of AI-authored extortion records showed operators examining stolen financial information to estimate what victims could pay without involving a bank or insurer. They then used masked proof samples, scripted vishing calls and threats to contact customers, partners and regulators to increase pressure.
The report described deadlines of 24–72 hours, followed by publication of stolen data when demands went unpaid. The financial outcomes remain unknown: researchers recovered no cryptocurrency wallet or payment record establishing whether victims paid.
