Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
Cybersecurity experts have uncovered an AI-powered intrusion network orchestrated by affiliates of ransomware groups INC and The Gentlemen. At the core of this operation is an autonomous red team kill chain framework known as Phantom. The threat actor, believed to be Russian-speaking, operates as both an intruder, data extorter, and infrastructure provider for various partners within the ransomware ecosystem.
The attackers targeted edge and remote-access systems, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways. They leveraged AI-managed knowledge bases to monitor victims, stolen credentials, and campaign progress. A distinctive feature of this campaign is its AI-executed, human-approved structure. A human operator provides a victim-specific prompt, and each step is reviewed before execution through OpenCode with OpenRouter-hosted commercial models.
The exposed directory at 45.227.254[.]43 revealed that the operators logged 8,257 messages across 133 sessions. If the AI models reject the prompts, the operator rewrites the requests as authorized red team assessments instead of switching models. Initial access was gained by exploiting public-facing edge devices at scale, followed by lateral movement, persistence establishment, data exfiltration, and ransomware deployment.
The attack lifecycle typically involved enumerating the domain, escalating to domain admin where possible, harvesting credentials with stealer tooling, prioritizing finance, HR, legal, and executive files, and collecting them over reverse-SOCKS tunnels. Credential reuse played a significant role; in one instance, a single reused password unlocked multiple systems.
Security products were undermined using a BYOVD killer and loader-level evasion techniques, although the operators' own logs showed mixed results against enterprise EDRs.
The threat actors used a diverse toolkit, including bespoke frameworks, modified open-source tools, and compiled binaries. Notable tools included the Cloudflare-fronted Mythic agent QuickLine, a Quick Heal/Seqrite EDR killer that exploits the Zemana driver (zam64.sys) in a BYOVD attack, and exfiltration programs like rks3 and BackupAgent.
Stolen data was analyzed to determine an amount victims could pay without involving a bank or insurer, followed by masked proof samples and pressure through scripted vishing calls and threats to notify customers, partners, and regulators. Stolen data was published on data leak sites if payment wasn't made within 24-72 hours. However, no cryptocurrency wallets or payment records were recovered.
A total of 62 organizations were targeted, with four listed on data leak sites for INC and The Gentlemen ransomware. The U.S. accounted for over 50% of the targets, with industrial, manufacturing, and energy sectors being the primary victims, followed by healthcare and pharmaceutical organizations. The operators extensively exploited exposed internet services, targeting FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls.
They established RevSocks reverse-SOCKS proxies for network pivoting, deployed Ghost C2 variants, and used AI-managed knowledge bases to meticulously log victim telemetry, compromised credentials, and active campaign statuses.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
