IN late September 2026, security researchers uncovered seven INC Ransomware command servers that exposed AI-driven activity and bespoke malware used by affiliates of the group. The exposed AI workbench contained 8,257 messages across 133 OpenCode sessions and more than $23,920 spent on commercial models. Researchers also recovered the Phantom framework alongside 46 custom encryptors built for six victim organisations.
The findings tie into a broader ecosystem that includes The Gentlemen Ransomware and the INC Ransomware affiliates, with attribution pointing to an operator group using a shared infrastructure.
The investigation traces initial access to exploitation of public edge servers, including CVE-2026-35616 in FortiClient EMS across 2,236 targets, which created 108 backdoor administrator accounts and reached 4,140 managed endpoints. Additional activity involved CVE-2024-57727 across 4,922 SimpleHelp servers, harvesting 427 administrator passwords and affecting 242 unique IPs, and CVE-2026-41940 involving brute-force breaches of small hosting providers via a cPanel authentication bypass.
Internal case files matched victims listed on the INC leak portal, while extortion messages from The Gentlemen were found in another folder, reinforcing a link between affiliates and The Gentlemen Ransomware.
Defence guidance within the piece urges urgent patching of FortiClient EMS, SimpleHelp, and cPanel, auditing for rogue admin accounts, and blocking vulnerable kernel drivers such as Zemana. It also emphasises phishing-resistant MFA, backup isolation, and staff training to recognise scripted vishing, based on the authors’ analysis of the attackers’ methods and tooling.