Oct 20, 202618 Mins ReadSummarize with:
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and thework”. Configuration files, logs and credentials inside that server led STRU to six more exposed adversary-controlled servers
The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways. They used AI-managed knowledge bases to track victims, stolen credentials and campaign progress. The servers also held 46 custom INC encryptor builds staged for an October 1, 2026 deployment, evidence of a live victim encryption, and a branded extortion package for a case listed by The Gentlemen.
The campaign came to light in late September 2026 after OPSEC failures left the operators’d AI spending exceeds $23,000
This post summarizes the findings, TTPs and IOCs; the complete technical analysis is available in the full whitepaper.
Key Takeaways
- –AI is the operational core: Operators ran intrusions through OpenCode with OpenRouter-hosted commercial models, logging 8,257 messages across 133 sessions; recorded AI API spending exceeds $23,920
- –Ransomware deployment wave staged: 46 INC encryptor binaries were built for six victims and packed for an October 1, 2026 deployment; a September 30 SimpleHelp screenshot shows live encryption on a victim workstation
- –Edge devices exploited at scale (per operator records): FortiClient EMS (CVE-2026-35616, 2,236 targets, 108 created admins, 4,140 managed endpoints), SimpleHelp (CVE-2024-57727, 242 unique IP addresses impacted) and cPanel (CVE-2026-41940, 49+ claimed breaches)
- –Custom arsenal exposed: The Phantom framework, WormGPT-labelled MCP servers, Ghost C2, RevSocks, a Quick Heal/Seqrite BYOVD killer and exfiltration tooling were recovered in source and binary form
- –Victimology: 62 named organizations, 36 of them in the United States, led by industrial/manufacturing (16.1%) and healthcare (14.5%)
At a Glance
How the Infrastructure Was Discovered
The investigation began with an exposed command-and-control server at 45.227.254[.]43, whose open directories held the operators’ knowledge base, AI session logs and the Phantom led STRU to six more adversary servers, most hosted on AS267784 (Flyservers S.A.)
The operation timeline spans from Ghost C2 activity in mid-July to live encryption on September 30, 2026.
AI as the Co-Operator
STRU assesses with high confidence that the ecosystem’s defining trait is an AI-executed, human-approved operating structure. The human operator directs and approves, while the AI stack (OpenCode as the interface, OpenRouter-hosted models, the Phantom skill library and a persistent knowledge base) plans reconnaissance, selects techniques, generates commands, triages stolen data and drafts reports.
STRU analyzed 8,257 messages across 133 OpenCode sessions alongside three knowledge base iterations:
- –Human approval loop: Each campaign started with a victim-specific master prompt, and the AI waited for the operator’s approval before every step under the directive “coordinate every action with me”
- –Commercial models, not uncensored ones: The models were standard commercial LLMs; “WormGPT” was only a persona prompt. When models refused, the operator rewrote requests as “Authorized Red Team Assessment Request” templates instead of switching models
- –Operator profile: Russian-speaking operators, most active between 06:00 and 14:00 UTC, who used the AI for stealth decisions, tool debugging and OPSEC
- –Funding: A live check on October 5, 2026 found two active, paid OpenRouter accounts, one of them nearly exhausted after $23,920 in spending
This reliance on AI memory became the operation’s weakness: the knowledge bases and session logs form a complete evidence trail of the campaign.
Modus Operandi
Initial Access Through Edge Devices
The operators gained initial access by exploiting public-facing edge devices at scale, then moved laterally and escalated toward ransomware deployment, a methodology that aligns with tactics frequently observed in INC Ransomware intrusions, including the FortiBleed campaign previously analyzed by STRU. According to operator records, which are not independently verified:
- –FortiClient EMS (CVE-2026-35616): 2,236 targets, 108 created admin accounts and 4,140 managed endpoints; the operators planted backdoor admins and pushed payloads to endpoints through modified VPN connection scripts
- –SimpleHelp (CVE-2024-57727): Scans of 4,922 servers yielded 427 admin passwords, with 242 unique IP addresses impacted; stolen MSP technician credentials opened access to every client those technicians managed
- –cPanel (CVE-2026-41940): 49+ claimed breaches of small hosting providers, used as a springboard to the email and webmail servers they host
- –Other gateways: Ivanti, Citrix, SonicWall and OpenVPN devices were also evaluated, with three recorded compromises
Inside the Victim Network
Once inside, the operators followed a recurring lifecycle: enumerate the domain, escalate to domain admin where possible, harvest credentials with stealer tooling, prioritize finance, HR, legal and executive files, and collect them over reverse-SOCKS tunnels. Credential reuse was the main force multiplier; in one case, a single reused password unlocked the VPN, servers, RMM, backup and security management platforms at once. Security products were impaired with a BYOVD killer and loader-level evasion, although the operators’ own logs record mixed results against enterprise EDRs.
The Operator Arsenal
The exposed servers held the operators’ custom tooling in
- –Phantom: A modular “Autonomous Red Team Kill Chain Framework” with 18 skill modules, an autopilot and its own agents, which disguise themselves as Windows Update components
- –WormGPT-MCP: 32 MCP servers connecting the AI to tooling from reconnaissance to extortion, including a ransom-ops server with negotiation and pricing tools
- –Ghost C2: Three generations of polymorphic implants communicating over HTTPS through Cloudflare, Telegram or DNS
- –RevSocks: A reverse SOCKS5 framework used to pivot inside victim networks and stage exfiltration
- –Supporting tools: A Cloudflare-fronted Mythic agent (QuickLine), a Quick Heal/Seqrite killer abusing the Zemana driver, and the rks3 and BackupAgent exfiltration tools
A separate delivery service supports phishing through malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc; its only recorded campaign was an internal self-test.
INC Ransomware Deployment
INC Ransomware is a Rust-based RaaS tracked since August 2023 (G1032). The operators prepared 46 INC encryptor builds for six victims, each personalized with its own key and victim identifier, covering Windows and Linux. The Windows encryptor stops backup and database processes and services, deletes shadow copies through direct driver calls instead of vssadmin, appends the .INC extension and drops INC-README.txt notes that point victims to a Tor chat portal.
Three per-victim packages were packed on September 30, 2026 for a deployment wave on October 1, and crew chat confirms the timing (“tomorrow at 6 Moscow time, right?”). Deployment against these targets is unconfirmed, but a SimpleHelp screenshot from September 30 shows the encryptor running on a victim workstation.
The Extortion Playbook
AI-authored extortion records reveal a data-centric playbook that prefers data extortion over encryption. The operators estimate what a victim can pay from its own stolen financials, map compliance and customer data for leverage, send masked proof samples, and open with text-only emails to owners or executives without a price. Pressure then escalates through scripted vishing calls, customers and partners, regulators and finally publication, with 24 to 72 hour deadlines. Payment was planned in Monero, but no wallet or payment record was recovered.
- –Aidon: A EUR 15M demand was cut to EUR 4M/2.5M after the operator realized it had targeted the wrong parent company; the firm later appeared on INC’s leak site, though the link to this contact is not established
- –Leo Schachter Diamonds: A four-message extortion set signed “The Gentlemen” with a vishing plan; the victim is listed on The Gentlemen’s leak blog
- –Trulite Glass & Aluminum Solutions: A look-alike site, trulitesupport[.]com, warned the victim’s customers of the breach to pressure the company, linking to its INC leak post
- –Healthcare network: A 24-hour deadline with a AUD 3M to 8M price band
Attribution and Operating Model
Evidence ties the infrastructure to both brands. For The Gentlemen Ransomware, the Leo Schachter Diamonds case contains full group branding, a four-stage extortion progression and a vishing outline. For INC Ransomware, the link goes beyond branding: 46 custom encryptors decrypt the INC ransom note, three INC leak site victims (Aidon, Trulite and City of Princeton, TX) match internal case files, and chat logs from an onion INC administration panel and Rocket.Chat list the packages staged for October 1.
The operators also used FOFA API accounts tied to smilefacesec[@]gmail[.]com for scanning. Cross-referencing this address with the SOCRadar Threat Hunting module shows it was used to register a BreachForums account under the username “sm4l1st123”.
A partner onboarding guide (README_PARTNER.md) on 45.227.254[.]45 describes handing Phantom, OpenCode, the knowledge base and WormGPT-MCP servers to external operators, advertising “35 MCP servers”, “55+ tools” and “9K+ CVE PoC”.
Victimology
STRU graded 62 named organizations by the depth of observed activity: 4 publicly listed for extortion (L5), 4 at the encryption or extortion stage (L4), 14 with domain-level compromise (L3), 28 with a foothold or access (L2) and 12 at reconnaissance only (L1). The United States accounts for 36 of the 62.
- -Patch FortiClient EMS, Fortinet and SonicWall gateways, remove internet access to management interfaces, and review EMS for unauthorized admins or modified VPN connection scripts
- -Harden MSP and RMM environments with MFA, IP allowlists and dedicated admin accounts, and require the same controls from third-party MSPs
- -Inventory remote-access tools such as SimpleHelp, MeshCentral and N-central, patch them, restrict their use and block unauthorized software
- -Patch Zerologon, retire Windows Server 2008 R2 domain controllers, deploy LAPS and gMSAs, enforce admin tiering and audit replication permissions and AAD Connect accounts
- -Protect backups with immutable or air-gapped storage and isolate and patch Veeam consoles
- -Enable EDR tamper protection, enforce vulnerable driver blocklists and alert on security service deletion or interruption
- -Monitor outbound transfers to cloud storage and limit tools such as restic or rclone to authorized endpoints
- -Block remote Office template loading and HTML smuggling, and train staff to recognize vishing
- -Prepare data extortion response with retained IR services, legal and notification templates, and monitoring of typosquatting domains and leak sites
- -Isolate hypervisors, ESXi hosts and central file servers from user networks
Detection and Hunting
- -EMS and gateway anomalies: New privileged EMS accounts (sysadmin, fct_svc_*, ems_monitor_*), VPN profile changes, missing audit logs and forged client-certificate headers
- -Initial access and staging: Office downloading remote .dotm templates, script-styled URLs serving PowerShell, curl or certutil spawned by Office or browsers, and a scheduled task named RealtekAudioSvc
- -C2 and tunneling: RevSocks, Chisel or Ligolo traffic patterns, Python beacons with TLS verification disabled, mTLS panel URIs and DNS queries to the listed domains
- -AD and credential abuse: Replication requests from non-DC hosts, reads of shadow-copied ntds.dit, spikes in RC4 Kerberos service tickets and Netlogon secure channel anomalies
- -Lateral movement: Unauthorized RMM agents, scripts or remote sessions outside change windows, and Remote Registry started just before RDP is enabled
- -Defense impairment: Zemana driver loads paired with Quick Heal/Seqrite service termination or file deletion
- -Exfiltration: restic or rclone execution, large archives and bulk uploads to external object storage
- -Encryption: Restart Manager sessions from non-installer processes, \.X: volume opens followed by IOCTL 0x53C028, mass renames to .INC and INC-README.txt files
- -Brand misuse: Look-alike domains hosting notification pages that point customers to extortion blogs
For the full technical breakdown, including tooling internals, the encryptor analysis and extended IOCs, download the complete whitepaper.
MITRE ATT&CK Mapping
Indicators of Compromise (IOCs)
For the extended IOC list, visit the SOCRadar platform.
Frequently Asked Questions
What did SOCRadar uncover about INC and The Gentlemen ransomware affiliates?
SOCRadar Threat Research Unit uncovered seven exposed adversary-controlled servers used by affiliates operating with INC Ransomware and The Gentlemen Ransomware. The servers held AI session databases, a central knowledge base, the Phantom framework, C2 tooling, 46 INC encryptor builds and a branded extortion package for a case listed by The Gentlemen.
How did the attackers use AI in their operations?
The operators ran intrusions through OpenCode with commercial models hosted on OpenRouter, using a “WormGPT” persona prompt and MCP servers. The AI planned reconnaissance, generated commands, triaged data and drafted extortion material, while a human operator approved each step. When models refused, the operator rewrote requests as authorized red team assessments instead of switching models.
Which vulnerabilities did the INC and The Gentlemen affiliates exploit?
Operator records show active exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940), plus follow-on use of the Roundcube flaw CVE-2025-49113. ZeroLogon, PrintNightmare, noPac, a PAN-OS User-ID flaw and a FortiGate SAML bypass were attempted, and several other CVEs were developed or staged.
What is the Phantom framework?
Phantom is a modular “Autonomous Red Team Kill Chain Framework” built by the operators, with 18 SKILL modules, a routing engine, an autopilot orchestrator and Python and Go agents. It integrates with OpenCode so the AI can select techniques and task remote agents. Its agent masquerades as Windows Update components and calls back to api.iquickline[.]com.
Is The Gentlemen Ransomware allied with INC Ransomware?
STRU rates confidence in a formal dual-brand alliance as low. Confidence that operators of both groups used a shared operational environment is moderate-to-high, and the most plausible structure is a dedicated tooling and infrastructure provider supporting several ransomware partners.
Which organizations were targeted?
The records name 62 organizations, 36 of them in the United States, with industrial, manufacturing and energy (16.1%) and healthcare and pharma (14.5%) the most targeted sectors. Four organizations reached public extortion listings and 14 suffered domain-level compromise.
Is patching edge devices enough to defend against these affiliates?
Patching FortiClient EMS, SimpleHelp, cPanel and VPN gateways closes the main entry points, but the operators also relied on stolen and reused credentials and on access already planted in EMS and RMM tools. Defenders should also hunt for rogue EMS admins and modified VPN on_connect scripts, rotate credentials, enforce MFA on RMM and VPN access and protect backups.
SOCRadar Threat Research Unit (STRU)
