Most ransomware crews rely on human operators to manually pivot through a network and hunt for sensitive files, but a Russian-speaking group tied to the INC and The Gentlemen gangs has figured out how to automate the entire intrusion lifecycle, and researchers at SOCRadar just exposed the framework they are using to do it.

The operation centers on an offensive security framework called Phantom, and it functions as an "AI-executed, human-approved" system, where a human operator simply feeds a target prompt into the AI, reviews the output, and lets the model handle the heavy lifting via OpenCode and commercial models hosted on OpenRouter.

The Exposed Infrastructure and the AI Evasion Tactic

The only reason we know the inner workings of this campaign is because the threat actors left their command-and-control directory completely exposed at 45.227.254[.]43, and that server logged over 8,200 messages across 133 distinct sessions, giving researchers a clear view into exactly how the system operates.

The most interesting tactic involves how they get around commercial AI safety filters, because when the model refuses to write an exploit or execute a malicious command, the operator doesn't switch to a different tool, and instead, they rewrite the prompt to tell the AI it's conducting an "authorized red team assessment," which tricks the model into bypassing its own guardrails and continuing the automated lateral movement and data exfiltration.

The Vulnerabilities Fueling the AI-Driven Ransomware Campaign

The Phantom framework isn't relying on zero-days, because it systematically scans the internet for known, unpatched edge devices, and the operators keep a specific target list of flaws they can leverage at scale.

Once the AI gets inside, it runs a standard playbook, enumerating the domain, escalating to domain admin, dumping credentials, and hunting for finance, HR, and legal files, and the operator logs confirmed that basic credential reuse was the biggest force multiplier, noting one case where a single reused password unlocked the VPN, backup servers, and security management platforms all at once.

The Toolkit: Phantom, WormGPT-MCP, and Ghost C2

To pull off these attacks, the operators are leaning on a toolkit that mixes custom AI frameworks with modified open-source binaries, and the core components include:

• Phantom: The primary AI-powered offensive security framework, which runs 18 different skill modules to handle reconnaissance, binary reverse engineering, and EDR fingerprinting.
• WormGPT-MCP: A set of 32 Model Context Protocol servers that bridge the AI system to various attack modules.
• Ghost C2: A collection of three generations of polymorphic implants that hide their traffic over Cloudflare, Telegram, or DNS to maintain persistent beacons.
• RevSocks: A reverse SOCKS5 framework used to tunnel into victim networks and stage stolen data.
• QuickLine and BYOVD Killers: A Cloudflare-fronted Mythic agent, alongside a Quick Heal/Seqrite EDR killer that abuses the Zemana driver (zam64.sys) in a Bring Your Own Vulnerable Driver attack.

AI-Written Extortion and Victim Targeting

The AI doesn't just break in, because it also handles the extortion math, and the operators feed stolen financial data into the model so it can calculate exactly how much a victim can pay without triggering a bank or insurance investigation.

From there, it generates masked proof samples and scripts for threatening phone calls, giving the victim a strict 24 to 72-hour deadline before the data gets published, and researchers estimate 62 organizations have been targeted so far, mostly in manufacturing, energy, and healthcare, with more than half located in the US.

How to Defend Your Perimeter

Because this campaign relies on exploiting exposed edge devices, organizations have to lock down their external attack surface immediately.

• Patch the edge: Prioritize updates for FortiClient EMS, SimpleHelp, cPanel, and SonicWall appliances.
• Stop credential reuse: Credential reuse was the primary cause of these attacks , so deploy MFA and unique passwords for both your VPN and remote management tools.
• Hunt for RevSocks: Monitor your network logs for the deployment of reverse-SOCKS tunnels and unusual outbound traffic.
• Watch for BYOVD: Look for the abuse of the Zemana driver (zam64.sys) attempting to disable your EDR.
• Hide management interfaces: Never expose SimpleHelp or cPanel directly to the public internet without IP whitelisting.

FAQ

What is the Phantom framework?

Think of it as an automated hacking platform. It's built on OpenCode and connects to commercial AI models to do the dirty work, so the human just types out a goal, and Phantom uses the AI to handle the reconnaissance, break in, and steal the data.

How do the attackers bypass AI safety filters?

It's surprisingly simple, they just lie to it. When a model refuses to write an exploit because it detects malicious intent, the human doesn't go find a new tool, and instead, they just tweak the prompt to tell the AI that it is an "authorized red team assessment," which tricks the model into executing the commands.

Which vulnerabilities are actively exploited?

Right now, they're primarily hammering three flaws: CVE-2024-57727 (a path traversal in SimpleHelp), CVE-2026-35616 (an auth bypass in FortiClient EMS), and CVE-2026-41940 (an auth bypass in cPanel/WHM), though they also have a few others staged and ready to go.

Is this campaign linked to INC and The Gentlemen ransomware?

Yes, they're definitely tied to them, and researchers assess that this crew is acting as the middleman, breaking into the network and stealing the data before handing off access to the big ransomware gangs to handle the actual extortion and encryption.

How does the AI handle extortion?

The AI does the math, because the operators feed it the victim's stolen financial records, and it calculates exactly how much the company can pay without having to involve their bank or an insurance provider, before spitting out the masked proof samples and scripts for the threatening phone calls.

Source: The Hacker News