al-ice.ai

8,257 Messages, 133 Sessions, $23,920: The Ransomware Crew That Let AI Run the Intrusion

Agent & Supply Chain Security by al-ice.ai Editorial

In late September 2026, affiliates operating with INC Ransomware and The Gentlemen Ransomware left a command-and-control server publicly accessible — open directories holding their AI session databases, their central knowledge base, and the source code of Phantom, a modular “Autonomous Red Team Kill Chain Framework.” Configuration files, logs and credentials on that one host at 45.227.254[.]43 led the SOCRadar Threat Research Unit to six more exposed adversary servers, most hosted on AS267784 (Flyservers S.A.). The result, published 20 October and updated 23 October, is the most complete picture yet of an AI-executed, human-approved ransomware operation: the human directs and approves while the AI stack plans reconnaissance, picks techniques, generates commands, triages stolen data and drafts reports. We read the report first-hand, in full.

This is not the first Gentlemen-affiliate AI story on this site. On 6 October we covered CloudSEK’s finding of a Gentlemen affiliate running an attack through an MCP tool call — a single execution channel. What SOCRadar found is a different and larger thing: a standing intrusion-development workbench, with its own framework, its own knowledge base, and 133 logged sessions. The two reports share a group and a pattern — AI tooling mediating real intrusions — and are otherwise separate operations by separate evidence. This post builds on the earlier one rather than restating it.

The stack: OpenCode, commercial models, and a persona called WormGPT

The operators ran their intrusions through OpenCode with OpenRouter-hosted commercial models — SOCRadar names anthropic/claude-opus-4.6 and moonshotai/kimi-k3 — across 8,257 messages in 133 sessions and three knowledge-base iterations. Each campaign opened with a victim-specific master prompt, and the AI waited for operator approval before every step under the directive “coordinate every action with me.” That approval loop is the report’s defining assessment, delivered with high confidence: AI-executed, human-approved.

Two details in the model story deserve to travel with every citation. First, the models were standard commercial LLMs, not uncensored ones — “WormGPT” in this infrastructure was only a persona prompt, and one of 32 MCP servers at that. When models refused, the operator did not switch models; he rewrote the request as an “Authorized Red Team Assessment Request” template. Evasion here is prompt-shaped, running on legitimate paid API accounts: a live check on 5 October found two active, paid OpenRouter accounts, one of them nearly exhausted after $23,920 in spending. Second, the operation’s reliance on AI memory became its weakness — the knowledge bases and session logs form a complete evidence trail of the campaign. The attackers’ own tooling kept the best records the defenders will ever get.

Phantom itself is assessed as an operator-centric framework: 18 skill modules, an autopilot, and agents that disguise themselves as Windows Update components, wired to 32 WormGPT-labelled MCP servers spanning reconnaissance to extortion — including a ransom-ops server with negotiation and pricing tools. A partner onboarding guide (README_PARTNER.md) on the development hub describes handing Phantom, OpenCode, the knowledge base and the MCP servers to external operators, advertising “35 MCP servers,” “55+ tools” and “9K+ CVE PoC.” SOCRadar’s structural read is careful and worth preserving exactly: confidence in a formal dual-brand alliance is low, while confidence in a shared operational environment used by operators across both groups is moderate-to-high — most plausibly a dedicated tooling and infrastructure provider serving partners across the ransomware ecosystem.

How they got in, and what was staged

Initial access came from edge and remote-access devices exploited at scale, and here the report’s own caveat must be carried explicitly: the counts below are per operator records, which are not independently verified. With that framing: FortiClient EMS (CVE-2026-35616) at 2,236 targets with 108 created admin accounts and 4,140 managed endpoints, backdoored through planted admins and payloads pushed via modified VPN connection scripts; SimpleHelp (CVE-2024-57727) with 4,922 servers scanned yielding 427 admin passwords and 242 impacted IPs, stolen MSP technician credentials opening every client those technicians managed; and cPanel (CVE-2026-41940) with 49+ claimed breaches of small hosters used as springboards to hosted mail. We pulled the two load-bearing 2026 CVEs from NVD 2.0 directly: CVE-2026-35616 is an improper access control flaw in FortiClientEMS 7.4.5 through 7.4.6 allowing unauthenticated code or command execution via crafted requests, and CVE-2026-41940 is an authentication bypass in the cPanel/WHM login flow for versions after 11.40 giving unauthenticated remote access to the control panel. The identifiers check out; the scale figures remain the operators’ own telling.

The longer CVE list mixes the attempted, the developed, and the merely referenced: a PAN-OS User-ID authentication-portal buffer overflow (CVE-2026-0300) attempted as a 0-day without confirmed code execution, a Windows Netlogon flaw (CVE-2026-41089) developed and lab-tested with victim use unestablished, a WordPress flaw the report calls wp2shell (CVE-2026-63030) developed with use unestablished, and a LiteLLM SQL-injection identifier (CVE-2026-42208) developed or referenced — a data point readers of our LiteLLM attack-chain reconstruction will recognise as the same software family, surfacing here only as a line in an adversary’s backlog. Once inside, the lifecycle was conventional and effective: enumerate the domain, escalate to domain admin, harvest with stealer tooling, prioritise finance, HR, legal and executive files, exfiltrate over reverse-SOCKS tunnels — with credential reuse as the main force multiplier, one reused password unlocking VPN, servers, RMM, backup and security management at a single victim.

The deployment wave was concrete. Forty-six custom INC encryptor builds for six victims — Rust-based, each personalised with its own key and victim identifier, covering Windows and Linux — were packed on 30 September 2026 for deployment on 1 October, with crew chat confirming the timing (“tomorrow at 6 Moscow time, right?”). Deployment against those targets is unconfirmed, but a SimpleHelp screenshot from 30 September shows the encryptor running on a victim workstation. The Windows encryptor stops backup and database processes, deletes shadow copies through direct driver calls instead of vssadmin, appends .INC and drops INC-README.txt notes pointing at a Tor chat portal. Alongside it sat a branded extortion package for a case listed by The Gentlemen — and an extortion playbook, AI-authored, that prefers data extortion over encryption: price the victim from its own stolen financials, map compliance and customer data for leverage, open with text-only executive emails carrying no price, then escalate through scripted vishing, customers and partners, regulators, and publication on 24-to-72-hour deadlines. Payment was planned in Monero; no wallet or payment record was recovered.

Victims, attribution, and the arsenal around the edges

SOCRadar grades 62 named organisations by depth of observed activity — 4 publicly listed for extortion, 4 at encryption or extortion stage, 14 with domain-level compromise, 28 with foothold or access, 12 at reconnaissance only — with 36 in the United States, led by industrial/manufacturing/energy (16.1%) and healthcare/pharma (14.5%). Named cases include Aidon, where a €15M demand was cut to €4M/2.5M after the operator realised it had targeted the wrong parent company; Leo Schachter Diamonds, with a four-message Gentlemen-signed extortion set and a vishing plan; Trulite Glass & Aluminum, pressured through a look-alike customer-notice site at trulitesupport[.]com linking its INC leak post; and a healthcare network given a 24-hour deadline in an AUD 3M–8M band. The operators are assessed as Russian-speaking, most active 06:00–14:00 UTC, and FOFA scanning accounts tied to one Gmail address cross-reference to a BreachForums account — the small reused identifiers that keep unpicking supposedly compartmented operations.

Around Phantom sat the rest of the arsenal, recovered in source and binary form: Ghost C2 in three polymorphic generations over HTTPS-through-Cloudflare, Telegram or DNS; RevSocks reverse-SOCKS5 for pivoting and staging exfiltration; a Cloudflare-fronted Mythic/Athena agent; a Quick Heal/Seqrite killer abusing the Zemana driver with loader-level evasion; the rks3 and BackupAgent exfiltration tools; and a phishing delivery service built on malicious Word templates and HTML smuggling persisting via a scheduled task named RealtekAudioSvc — whose only recorded campaign was an internal self-test. Detection guidance in the report reads as a hunt list: EMS backdoor admin patterns, RealtekAudioSvc, Zemana-driver loads paired with security-service termination, restic/rclone to external storage, mass renames to .INC with INC-README.txt, and look-alike notification domains.

What we take from it

Three readings, labelled as ours. First, the commercial-model detail is the policy-relevant finding. No uncensored model, no jailbreak breakthrough — standard products on paid accounts, with refusals routed around by reframing templates. The control surface this implies is not model weights but API accounts, spend anomalies, and provider-side abuse handling: $23,920 through one account is a billing event before it is anything else, and OpenRouter sat in the middle of every one of those 8,257 messages. Anyone reasoning about “AI-enabled crime” as a weights problem is looking at the wrong layer; this crew rented the capability with a credit card.

Second, the partner guide is the professionalisation signal. A README_PARTNER.md that onboards external operators onto Phantom, OpenCode, the knowledge base and dozens of MCP servers is ransomware-as-a-service growing a developer platform — and it explains the report’s careful alliance assessment. If Phantom is a product sold to affiliates across brands, then the INC/Gentlemen co-presence is a customer list, not a merger. The defensive corollary: tooling-provider takedowns and infrastructure chokepoints (the Flyservers-heavy hosting footprint, the two OpenRouter accounts) have more leverage than brand-oriented attribution.

Third, the evidence-trail property generalises beyond this crew. Agent-executed operations that depend on persistent memory produce session logs and knowledge bases as a side effect of functioning at all — and those artifacts, when exposed, are more complete than anything victim-side forensics reconstructs. The operators’ OPSEC failure here was leaving servers open, but the deeper failure was architectural: an AI co-operator that cannot work without remembering is an adversary that cannot operate without writing everything down. Defenders who find one exposed node should assume, as SOCRadar did, that it points to the rest.

Our verification was read-only and external. SOCRadar’s “INC and The Gentlemen Ransomware: Exposed AI Infrastructure” (published 20 October 2026, updated 23 October) was read first-hand in full — the seven servers and their roles, the 8,257-message / 133-session figures, the OpenCode/OpenRouter/claude-opus-4.6/kimi-k3 stack, the approval-loop directive, the persona-prompt and reframing-template details, the $23,920 spend figure, the Phantom module and MCP-server counts, the partner-guide advertising lines, the per-operator-record exploitation counts with the report’s own not-independently-verified caveat, the 46-encryptor / 1 October staging with its unconfirmed-deployment qualification, the victim-grading and sector figures, the named-case details, the Monero-no-wallet statement, the attribution and confidence assessments, and the detection guidance. CVE-2026-35616 and CVE-2026-41940 were pulled directly from the NVD 2.0 API for description and affected versions; the remaining CVE identifiers are carried as the report lists them, with the report’s caveat. Brave Search was used for discovery only. We ran no tooling, contacted no adversary server, resolved no indicator, and retrieved no encryptor, credential, or session artifact.

Sources: