Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Ransomware affiliates hand the intrusion to AI agents, with a human approving each step

A leaked operator server tied to INC and The Gentlemen affiliates shows AI agents breaching about 62 organizations through FortiClient EMS, SimpleHelp and cPanel flaws. A human signs off on every step.

4T4Tify Team4Tify
Oct 24, 2026·6 min read
Ransomware affiliates hand the intrusion to AI agents, with a human approving each step

Ransomware affiliates are letting AI agents run the intrusion — with a human clicking "approve"

An exposed operator server tied to affiliates of the INC and The Gentlemen ransomware groups shows what an AI-driven intrusion workflow looks like in practice. Agents carry out most of the hands-on-keyboard work. A human picks the victim and signs off on each step.

What happened

The leaked directory belongs to an actor assessed to be Russian-speaking. It holds a custom framework the operators call Phantom, which they describe as an "autonomous red team kill chain". The same actor appears to work two jobs: running intrusions and extortion directly, and renting out infrastructure to other partners in the ransomware ecosystem.

The model is "AI-executed, human-approved". The operator writes a prompt for a specific victim and reviews each action. The steps themselves run through the open-source OpenCode agent, backed by commercial large language models reached through a model-routing service. Logs from the server cover more than 8,200 messages across 133 sessions. When a model refused a task, the operator usually didn't switch models. They reworded the request so it looked like an authorized red-team engagement.

Initial access came from mass exploitation of internet-facing edge and remote-access systems. Operator records reference these flaws:

  • CVE-2024-57727: SimpleHelp path traversal (actively exploited)
  • CVE-2026-35616: Fortinet FortiClient EMS authentication bypass (actively exploited)
  • CVE-2026-41940: cPanel/WHM authentication bypass (actively exploited)
  • CVE-2026-15409: SonicWall SMA 1000 SSRF (staged for targeting, no confirmed compromise)
  • CVE-2026-63030: WordPress (exploit developed)
  • CVE-2026-42208: LiteLLM SQL injection (developed or referenced)
  • CVE-2026-9082: Drupal SQL injection (developed or referenced)

Ivanti, Citrix, SonicWall and OpenVPN gateways were also on the target list.

After getting in, the operators repeated the same routine each time. They mapped the domain, went for domain admin where they could, and harvested credentials with stealer tooling. Next they pulled finance, HR, legal and executive files and moved them out through reverse-SOCKS tunnels. Password reuse did the most damage. In one victim, a single reused password opened the VPN, servers, remote-management, backup and security consoles all at once. The operators tried to blind defenders with a bring-your-own-vulnerable-driver (BYOVD) EDR killer and loader-level evasion. By their own notes, results against enterprise EDR were mixed.

The toolkit mixes custom and repurposed components:

  • Phantom, the AI offensive framework, runs live through OpenCode. Its agent pulls tasks from a remote server and returns command output. It has 18 skill modules covering recon, reverse engineering, exploit research, steganography and EDR fingerprinting.
  • WormGPT-MCP is a set of 32 Model Context Protocol servers that connect the AI to modules covering everything from reconnaissance to extortion.
  • Ghost C2 has three generations of polymorphic implants that beacon over Cloudflare, Telegram or DNS.
  • RevSocks is a reverse SOCKS5 tool used for pivoting and for staging data before it leaves.
  • The rest of the toolkit includes a Cloudflare-fronted Mythic agent ("QuickLine"), a Quick Heal/Seqrite EDR killer that abuses the Zemana zam64.sys driver, and the exfiltration utilities rks3 and BackupAgent.

AI-managed knowledge bases kept track of victims, stolen credentials and the status of each campaign.

The extortion side is just as methodical. The AI drafted extortion records that read the victim's own financials to set a ransom it could pay without involving a bank or insurer. The operators then sent masked proof samples and followed up with scripted vishing calls. They also threatened to notify customers, partners and regulators. Victims who don't pay within 24 to 72 hours have their data leaked. No wallet or payment records were recovered, so we don't know whether any victim paid.

Around 62 organizations appear to have been targeted, and four of them were later listed on the INC and The Gentlemen leak sites. More than half of the targets are in the United States. Industrial, manufacturing and energy companies were hit hardest, followed by healthcare and pharmaceutical firms.

Why it matters

None of the entry points is new. They are known, patchable flaws in VPNs, remote-management tools and hosting panels. What has changed is the economics. When an AI agent runs the reconnaissance, lateral movement and paperwork, one affiliate can work dozens of victims in parallel. The window between a public edge-device CVE and mass exploitation keeps shrinking. Logs like these also show that model guardrails can be talked around, so they won't hold back a determined operator.

What to do

  • Patch internet-facing edge and remote-access systems first. Check FortiClient EMS, SimpleHelp, cPanel/WHM, SonicWall SMA, Ivanti, Citrix and OpenVPN against the CVEs above. Treat any unpatched exposure as possibly already compromised.
  • Kill credential reuse. Use unique passwords and phishing-resistant MFA on VPN, RMM, backup and security consoles. Keep those admin accounts separate from day-to-day domain accounts.
  • Block vulnerable drivers. Turn on Microsoft's vulnerable driver blocklist or an equivalent control, and alert on driver loads such as zam64.sys.
  • Watch for tunnelling and odd egress. Look for reverse-SOCKS tunnels and C2 beaconing over Cloudflare, Telegram or DNS, plus large outbound transfers of finance, HR or legal data.
  • Harden admin panels. Take management interfaces off the open internet and put them behind VPN or zero-trust access.
  • Prepare for the pressure call. Brief executives and front-line staff that extortion now arrives with scripted phone calls and threats to contact customers and regulators.

You can't patch what you don't know is exposed, and campaigns like this one start with the forgotten VPN gateway or RMM server. Our Attack Surface Management service continuously maps an organization's internet-facing assets and flags exposed edge devices and known-exploited CVEs, so they can be fixed before an affiliate's agent gets there first.

SHARE