Overview
Researchers have uncovered an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Its core is an "Autonomous Red Team Kill Chain Framework" called Phantom. The operator is assessed to be Russian-speaking, and works both as an intrusion and extortion actor and as an infrastructure provider for other ransomware partners.
The structure is described as AI-executed and human-approved. A human writes a victim-specific prompt and reviews each step, while OpenCode and commercial models hosted on OpenRouter carry out the work. When a model refuses a task, the operator reportedly rewrites the request as an authorized red team assessment. An exposed directory at 45.227.254[.]43 logged 8,257 messages across 133 sessions.
Initial Access
| CVE | Product | Status |
|---|---|---|
| CVE-2024-57727 | SimpleHelp path traversal | Actively exploited |
| CVE-2026-35616 | Fortinet FortiClient authentication bypass | Actively exploited |
| CVE-2026-41940 | cPanel/WHM authentication bypass | Actively exploited |
| CVE-2026-15409 | SonicWall SMA 1000 SSRF | Staged, no confirmed compromise |
| CVE-2026-63030 | WordPress "wp2shell" | Exploit developed |
| CVE-2026-42208 | LiteLLM SQL injection | Developed or referenced |
| CVE-2026-9082 | Drupal SQL injection | Developed or referenced |
Toolkit
- Phantom: AI offensive framework run through OpenCode, with an agent that polls an external server for tasks and 18 skill modules covering reconnaissance, reverse engineering, exploit research, steganography, and EDR fingerprinting.
- WormGPT-MCP: 32 Model Context Protocol servers linking the AI system to modules from reconnaissance through extortion.
- Ghost C2: three generations of polymorphic implants communicating over Cloudflare, Telegram, or DNS.
- RevSocks: reverse SOCKS5 framework for pivoting and staging data.
- Other tools: a Cloudflare-fronted Mythic agent (QuickLine), a Quick Heal/Seqrite EDR killer abusing the Zemana driver (
zam64.sys), and exfiltration programsrks3andBackupAgent.
After access, operators enumerate the domain, escalate to domain admin, harvest credentials, and prioritize finance, HR, legal, and executive files. Credential reuse was the main force multiplier: in one case a single reused password opened the VPN, servers, RMM, backup, and security management platforms. The operators' own logs show mixed results against enterprise EDR products.
Extortion and Scope
Operators estimate how much a victim can pay without involving a bank or insurer, send masked proof samples, run scripted vishing calls, and threaten to notify customers, partners, and regulators. Data is leaked if payment is not made within 24 to 72 hours. No wallet or payment record has been recovered, so outcomes are unknown.
About 62 organizations were targeted and four appeared on INC or Gentlemen leak sites. The U.S. accounts for over half of targets, mainly in industrial, manufacturing, and energy, followed by healthcare and pharmaceuticals.
Defensive Takeaways
The source gives no formal mitigation guidance. The following is our own reading of the findings:
- Patch and monitor internet-facing edge and remote-access products, especially the CVEs listed above.
- Enforce unique credentials and MFA to limit the damage of reuse.
- Watch for BYOVD driver abuse and tunneling tools such as reverse SOCKS.