Exposed server shows INC and Gentlemen ransomware affiliates running intrusions with AI agents
SOCRadar found a misconfigured server revealing how a Russian-speaking ransomware affiliate used AI coding agents, with human approval, to breach about 62 organizations.
At a glance
- An exposed directory logged 8,257 messages across 133 sessions of an "AI-executed, human-approved" intrusion workflow
- About 62 organizations were targeted, more than half in the US, and four appeared on INC or The Gentlemen leak sites
- Initial access relied on exploited flaws in SimpleHelp, Fortinet FortiClient EMS and cPanel/WHM, among others
- Credential reuse was the main force multiplier, with one password unlocking VPN, RMM, backup and security tools
A misconfigured server has exposed how a Russian-speaking affiliate of the INC and The Gentlemen ransomware operations used AI agents to carry out network intrusions against roughly 62 organizations, The Hacker News reported on October 23, citing research by SOCRadar. The findings offer a rare look at a ransomware crew that let commercial AI models execute much of the attack while a human approved each step.
What happened
According to the report, SOCRadar found an exposed directory at 45.227.254[.]43 that logged 8,257 messages across 133 sessions. The operator described in the research ran what SOCRadar calls an "AI-executed, human-approved operating structure": a human wrote a victim-specific prompt and reviewed every action, while the intrusion itself ran through the OpenCode agent using commercial models hosted on OpenRouter. When a model refused a request, the operator reportedly rewrote it as an authorized red team assessment rather than switching models. AI-managed knowledge bases tracked victims, stolen credentials and campaign progress.
The Hacker News reports that the actor works both as an intrusion and data-extortion operator and as an infrastructure provider for other partners in the ransomware ecosystem.
Technical details
Initial access came from mass exploitation of edge and remote-access systems. The records list actively exploited flaws such as the SimpleHelp path traversal CVE-2024-57727, the Fortinet FortiClient authentication bypass CVE-2026-35616 and the cPanel/WHM authentication bypass CVE-2026-41940, alongside others that were staged or researched. After entry, operators enumerated domains, escalated to domain admin where possible, harvested credentials and prioritized finance, HR, legal and executive files, exfiltrating data over reverse-SOCKS tunnels.
The toolkit included an AI offensive framework dubbed Phantom with 18 skill modules, a set of 32 Model Context Protocol servers called WormGPT-MCP, polymorphic Ghost C2 implants communicating over Cloudflare, Telegram or DNS, and an EDR killer abusing the Zemana driver (zam64.sys). The operators' own logs show mixed results against enterprise EDR products, according to the report.
Who is affected
More than half of the roughly 62 targeted organizations are in the US, with industrial, manufacturing and energy companies most affected, followed by healthcare and pharmaceutical firms. Four victims were listed on the INC or The Gentlemen leak sites. The final outcomes are unknown because no cryptocurrency wallet or payment record was recovered. Extortion relied on financial analysis of stolen data, scripted vishing calls and 24 to 72 hour deadlines.
What to do
The article does not include defensive recommendations. Based on the access vectors it describes, organizations should prioritize patching internet-facing SimpleHelp, FortiClient EMS, cPanel/WHM, Ivanti, Citrix, SonicWall and OpenVPN systems, eliminate password reuse across VPN, RMM, backup and security consoles, enforce phishing-resistant MFA on remote access, and monitor for vulnerable driver loading such as zam64.sys.
Related CVEs
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
