SOCRadar exposes AI-driven ransomware operations by INC and The Gentlemen

Cybersecurity researchers at SOCRadar have uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. The investigation revealed seven exposed servers containing stolen credentials, 46 custom encryptor builds, and 8,257 AI messages across 133 OpenCode sessions.

The threat actors, assessed to be Russian-speaking, utilized an “Autonomous Red Team Kill Chain Framework” known as Phantom. This structure follows an “AI-executed, human-approved” model where operators use commercial AI models, such as Claude Opus and Kimi K3, to plan reconnaissance, generate commands, and analyze stolen data. When commercial models refused malicious requests, operators reportedly bypassed restrictions by rephrasing prompts as “Authorized Red Team Assessment Requests.”

To gain initial access, the groups exploited various internet-facing vulnerabilities, including flaws in cPanel, SimpleHelp, and Fortinet FortiClient. The operators used AI-managed knowledge bases to track victims and campaign progress, maintaining human control over every step of the attack process.