SOCRADAR Threat Research Unit (STRU) has disclosed an AI-driven intrusion ecosystem operated by affiliates of INC Ransomware and The Gentlemen Ransomware. A publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the Phantom “Autonomous Red Team Kill Chain Framework” source, with configuration files, logs and credentials pointing to six additional adversary-controlled servers.
The operators targeted edge and remote-access systems at scale, including FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel (CVE-2026-41940), using an AI-managed knowledge base to track victims, stolen credentials and campaign progress. The servers also contained 46 custom INC encryptor builds staged for an October 1, 2026 deployment, with evidence of live encryption and a branded extortion package tied to The Gentlemen.
STRU notes the operation integrated a substantial AI stack: OpenCode as the interface, OpenRouter-hosted models (anthropic/claude-opus-4.6), a persistent knowledge base and the Phantom toolkit, plus MCP servers and Ghost C2 tooling. The campaign affected 62 named organisations (36 in the United States), spanning industrial/manufacturing and healthcare sectors.
The observed MITRE-aligned activity covered initial access through public-facing edges, credential harvesting, lateral movement and data exfiltration, culminating in 46 encryptor payloads and extortion playbooks. The AI was used to plan reconnaissance, generate commands and draft reports, with a human operator retaining approval at each step. Fortinet, SimpleHelp and VPN gateways were the primary ingress points, while weaknesses in credential reuse and BYOVD-style evasion aided pursuit of targets. A full technical whitepaper is available from SOCRadar.