SOCRadar · Published 20 Oct
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
By ST SOCRadar Threat Research Unit (STRU)
Excerpt
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that server led STRU to six more exposed adversary-controlled servers.
The operators exploited edge and remote-access systems at scale, inc…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by SOCRadar on socradar.io.
Mentioned in the excerpt2
More from SOCRadar7
SOCRadar · Web page · Published 12 Oct
Inside ICMacOS: From an Infostealer to a Persistent RAT
Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly…
SOCRadar · Web page · Published 3 Aug
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…
SOCRadar · Web page · Published 28 Jul
Dark Web Profile: ExfilSquad
ExfilSquad is an emerging data-extortion group that surfaced with a rapid wave of public claims and a Tor-hosted Data Leak Site (DLS). The group is associated with an “only exfiltration” model, suggesting a focus on data theft rather than confirmed file…
SOCRadar · Web page · Published 18 Mar
Dark Web Profile: ShinyHunters
[Update] July 31, 2025: “ShinyHunters Behind CRM Attacks on Qantas, Adidas, and Others” Within the obscured world of the Deep/Dark Web, where cybercrime flourishes amidst databases, initial access brokers, and a plethora of illegal activities, there exists a…
On the same topics
shaddy43.com · Web page · Published 13 Oct
Breaking Akira’s Clock: Recovering Files Without the Ransom Key
Malware Analysis Series · 13 October 2026 · updated 23 October 2026 · by shaddy43 An Akira-branded Windows encryptor builds every file key from the machine’s uptime. We take it apart function by function, show how a responder can turn that into decrypted…
Check Point · Web page · Published 3 Dec
Inside Akira Ransomware's Rust Experiment
Check Point Research analyzed the construction and control flow of Akira ransomware’s Rust version that circulated in early 2024, which has specific features uniquely targeting ESXi server. Our analysis demonstrates how Rust idioms, boilerplate code, and…
The Hacker News · Web page · Published 26 Oct
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver…
Synacktiv · Web page · Added 25 Oct
Etude de cas : Comment Hunters International et ses affiliés ciblent
Hunters International est un groupe de Ransomware-as-a-Service (RaaS) apparu en octobre 2023, après avoir acquis le code source et l'infrastructure du groupe Hive, aujourd'hui démantelé. À ce jour, selon les statistiques publiées, Hunters International et ses…