Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups to execute sophisticated attacks.
The operation, dubbed "Autonomous Red Team Kill Chain Framework" and named Phantom, represents a significant evolution in ransomware tactics. The threat actors, assessed to be Russian-speaking, function both as intrusion operators and infrastructure providers supporting various partners across the ransomware ecosystem.
The campaign employs an "AI-executed, human-approved operating structure" where human operators provide victim-specific prompts and review each step, while intrusions are executed through OpenCode with OpenRouter-hosted commercial models. Examination of exposed infrastructure revealed 8,257 messages logged across 133 sessions.
Exploitation Methods
The attackers exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways. Initial access is achieved by exploiting public-facing edge devices, followed by lateral movement, establishing persistence, data exfiltration, and ransomware deployment.
The campaign leverages multiple vulnerabilities, with several actively exploited including CVE-2024-57727 (SimpleHelp path traversal), CVE-2026-35616 (Fortinet FortiClient authentication bypass), and CVE-2026-41940 (cPanel/WHM authentication bypass). Other vulnerabilities are either staged for targeting or still in development.
Attack Lifecycle
Once inside compromised networks, the operators follow a recurring lifecycle: enumerating the domain, escalating to domain admin where possible, harvesting credentials with stealer tools, prioritizing finance, HR, legal and executive files, and collecting them over reverse-SOCKS tunnels.
Credential reuse serves as a significant force multiplier in these attacks. In one case, a single reused password unlocked multiple systems including VPN, servers, RMM, backup and security management platforms simultaneously.
The attackers employ security evasion techniques including a BYOVD killer and loader-level evasion, though their own logs show mixed results against enterprise EDR solutions.
Sophisticated Toolkit
The operation is supported by a diverse toolkit comprising bespoke frameworks and modified open-source tools. Phantom, the AI-powered offensive security framework, is deployed in live operations via OpenCode and supports 18 skill modules for various functions including reconnaissance and EDR fingerprinting.
Other components include WormGPT-MCP (32 Model Context Protocol servers), Ghost C2 (polymorphic implants), RevSocks (reverse SOCKS5 framework), and various exfiltration programs. The actors also use a Cloudflare-fronted Mythic agent called QuickLine and a Quick Heal/Seqrite EDR killer.
Across this exposed infrastructure, the actors engaged in widespread exploitation of exposed internet services, specifically targeting FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls.
Extortion Tactics
The threat actors adopt a data-centric approach to extortion, examining stolen financials to determine the amount victims can pay without involving banks or insurers. They send masked proof samples and increase pressure through scripted vishing calls, threatening to notify customers, partners, and regulators.
Stolen data is published on data leak sites if victims fail to pay within a 24-72 hour deadline. The campaign has targeted 62 organizations, with four already listed on INC and The Gentlemen ransomware data leak sites. The U.S. accounts for over 50% of targets, with industrial, manufacturing, and energy sectors being primary targets, followed by healthcare and pharmaceutical organizations.
Related
