Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
Affiliates of the INC and The Gentlemen ransomware groups operated for months with an autonomous AI framework called Phantom, revealed on October 20, 2026, by the SOCRadar Threat Research Unit following a catastrophic OPSEC failure. The very mechanism that made intrusions scalable — a persistent knowledge base of victims, credentials, and campaign progress — left complete forensic traces on exposed servers. The discovery demonstrates that adopting commercial LLMs in cybercrime introduces novel operational vulnerabilities, where AI memory persistence translates into total exposure of the entire criminal chain.
- SOCRadar recovered 8,257 AI messages across 133 OpenCode sessions from an exposed C&C server at 45.227.254[.]43, with API spend exceeding $23,920 on two active OpenRouter accounts.
- The Phantom framework integrates 18 skill modules and 32 MCP servers (WormGPT-MCP), orchestrating reconnaissance, exploitation, EDR fingerprinting, and steganography via commercial Anthropic Claude and Moonshot Kimi models.
- The "AI-executed, human-approved" architecture requires step-by-step human approval with the directive "coordinate every action with me," but leaves detailed logs of every generated and executed command.
- The OPSEC failure exposed the knowledge base, Phantom source code, credentials, and logs, leading to the identification of six additional servers and 62 target organizations — only four of which are confirmed on the groups' data leak sites.
Phantom: The AI Factory With a Human License
The operation's central framework is Phantom, self-described as an "Autonomous Red Team Kill Chain Framework." According to source code recovered by SOCRadar, the system manages 18 specialized modules covering the full intrusion spectrum: initial reconnaissance, reverse engineering, exploit research, steganography, telemetry assessment, and EDR solution fingerprinting. Communication with models occurs via OpenCode, a protocol that allows AI agents to execute commands on target systems while receiving instructions from remote servers.
The models used are standard commercial services accessible on OpenRouter: anthropic/claude-opus-4.6 and moonshotai/kimi-k3. When models refused overtly harmful requests, operators rewrote prompts as "Authorized Red Team Assessment Request" — a jailbreaking technique based on context reframing. This pattern, documented in the logs of the 133 analyzed sessions, indicates operational familiarity with commercial LLM alignment mechanisms.
Human supervision remained constant: each campaign began with a victim-specific master prompt, and the AI awaited approval before every action. The recurring directive "coordinate every action with me" confirms the models' role was as a technical accelerator, not an autonomous agent. Scalability derived from Phantom's ability to maintain operational state across sessions, not from eliminating human control.
From the Edge to the Network: The Edge Vector and CVEs in the Field
Initial access systematically exploited exposed edge devices and remote access systems. Targeted technologies included FortiClient EMS, SimpleHelp, cPanel/WHM, and VPN gateways from Ivanti, Citrix, SonicWall, and OpenVPN. Three specific vulnerabilities were central to the playbook: CVE-2024-57727 (SimpleHelp, path traversal), CVE-2026-41940 (cPanel/WHM, authentication bypass), and CVE-2026-35616 (FortiClient EMS, authentication bypass, CVSS 9.8).
The latter, present in the CISA Known Exploited Vulnerabilities catalog with an addition date of April 6, 2026, and two dates of April 9, 2026, is the one with the greatest documented operational impact. According to operator records — explicitly qualified by SOCRadar as "operator-reported, not independently verified" — FortiClient EMS exploitation would have affected 2,236 targets, with the creation of 108 administrative accounts and management of 4,140 endpoints. For SimpleHelp, operators reported 242 unique IPs impacted from a scan of 4,922 servers. For cPanel, the internal count signaled 49 or more breaches of small hosting providers.
The post-exploitation toolkit includes Ghost C2 with three generations of polymorphic implants, RevSocks for reverse SOCKS5 tunneling, QuickLine for Mythic agents via Cloudflare, and a BYOVD to neutralize Quick Heal and Seqrite EDR through the zam64.sys driver. For exfiltration, rks3 and BackupAgent were available.
The Memory Trap: How AI Persistence Destroyed OPSEC
The discovery occurred in late September 2026 not through active defender analysis, but via open directories on C&C servers. From server 45.227.254[.]43 on AS267784 (Flyservers S.A.), researchers recovered the entire operational corpus. The AI knowledge base, designed to track victims, stolen credentials, and campaign progress, turned into a complete forensic ledger.
The expansion led to the identification of six additional servers, for a total of seven nodes. Among recovered materials: 46 custom INC encryptor builds for six victims, staged for October 1, 2026; screenshots from September 30, 2026, showing live encryption via SimpleHelp; and the full Phantom source code.
"This reliance on AI memory became the operation's weakness: the knowledge bases and session logs form a complete evidence trail of the campaign."
— SOCRadar Threat Research Unit
The paradox is structural. The scalable efficiency of the "AI-executed, human-approved" model depends on persistent memory that allows resuming campaigns without rebuilding context. But that same memory, when exposed, documents intentions, planning, tactical evolution, and victim identification with a precision that traditional logs would rarely achieve.
The Cost-Benefit Calculation: AI as Criminal Commodity
The numbers quantify the shift in the RaaS model toward an "AI-as-a-service" variant for affiliates. The API spend of over $23,920, detected on October 5, 2026, on two OpenRouter accounts, is a modest investment relative to potential revenues from 62 organizations. The geography — 36 in the United States, over 50% — with industrial sectors at 16.1%, healthcare at 14.5%, and energy, reflects targeting of critical infrastructure with low downtime tolerance.
The extortion approach is data-centric: analysis of stolen finances to calibrate ransom, masked proof samples, vishing scripts, threats to customers, partners, and regulators, 24-72 hour windows. The primary force multiplier was credential reuse: in one case, a repeated password unlocked VPN, servers, RMM, backup, and security management platforms.
Results against enterprise defenses were mixed. Despite BYOVD and loader-level evasion, logs show blocks by top-tier EDRs — AI automation advantages are not absolute against mature defenses.
What to Do Now
Guidance for defenders derives directly from patterns observed in the exposed infrastructure. At the perimeter, the priority is patching CVE-2026-35616 on FortiClient EMS, CVE-2024-57727 on SimpleHelp, and CVE-2026-41940 on cPanel/WHM, with specific monitoring of logs for unauthorized administrative account creation. Detecting OpenCode sessions requires analysis of traffic to commercial AI endpoints: logs show repeatable patterns of prompt rewriting with the formula "Authorized Red Team Assessment Request" that can serve as indicators of compromise.
For threat intelligence teams, the structure of exposed AI knowledge bases suggests searching for LLM session archives with victim-specific tracking, operational state files, and catalogs of stolen credentials. The presence of 32 MCP servers in the WormGPT-MCP toolkit indicates pre-intrusion reconnaissance is highly automated: edge service access logs must be correlated with mass scans rather than manual activity.
For AI vendors, the case documents the practical impossibility of programmatically distinguishing authorized red teaming from criminal activity when operators adopt context rewriting techniques. Unauthorized use controls must integrate operational pattern analysis — request frequency, prompt structure, relationship with known IP addresses — beyond isolated semantic content.
Frequently Asked Questions
Were the AI models used modified or trained for criminal purposes?
No. According to SOCRadar, they were standard commercial models on OpenRouter. "WormGPT" was a persona prompt applied to existing models, not a dedicated model.
Did the AI operate completely autonomously without human intervention?
No. The architecture was "AI-executed, human-approved": every step required approval, documented by the directive "coordinate every action with me."
Are the counts of thousands of targets independently verified?
No. SOCRadar explicitly qualifies the FortiClient (2,236 targets), SimpleHelp (242 IPs), and cPanel (49+ breaches) counts as "operator-reported, not independently verified."
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.