SOCRadar finds AI managed ransomware operation targeting 62 organizations

SOCRadar uncovered an AI managed intrusion operation linked to affiliates of the INC and The Gentlemen ransomware groups, according to The Hacker News. The researchers estimate that it targeted 62 organizations, with more than half in the US and most victims in the industrial, manufacturing, energy, healthcare, and pharmaceutical sectors.

The operation used a framework called Phantom through OpenCode and commercial models hosted by OpenRouter. A human operator supplied prompts for each victim and reviewed every step, while the AI executed intrusion tasks. Exposed infrastructure contained 8,257 messages across 133 sessions.

Attackers exploited public facing systems including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways. They used CVE-2026-35616 against FortiClient, while CVE-2026-15409 targeting SonicWall systems was prepared but not confirmed as exploited. After gaining access, they stole credentials, moved through networks, collected sensitive files, and prepared ransomware deployment.

The toolset included Phantom, 32 WormGPT MCP servers, Ghost C2 implants, and RevSocks proxies. Records showed that operators analyzed stolen financial data to set ransom demands, provided samples as proof, and threatened disclosure within 24 to 72 hours. Four targeted organizations appeared on the INC and The Gentlemen leak sites, but researchers found no payment records.