Exposed Server Shows Ransomware Affiliates Using AI Agents to Break Into Networks

Researchers at SOCRadar have uncovered an AI-driven intrusion operation run by affiliates of the INC and The Gentlemen ransomware groups. At its centre is a framework called Phantom, which the researchers assess is run by a Russian-speaking actor who carries out intrusions and data extortion and also supplies infrastructure to other partners in the ransomware ecosystem.

The operation uses what researchers call an "AI-executed, human-approved" structure. A human operator writes a victim-specific prompt and reviews every step, while commercial AI models carry out the intrusion work. An exposed directory logged 8,257 messages across 133 sessions. When a model refused a request, the operator reworded it as an authorised red team assessment rather than switching models. The group targeted internet-facing and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways, and used AI-managed knowledge bases to track victims and stolen credentials.

Once inside, the attackers followed a repeatable pattern: mapping the network, seeking administrator access, harvesting credentials, and prioritising finance, HR, legal and executive files for theft. Reused passwords were a major advantage; in one case a single password unlocked the VPN, servers, remote management, backup and security platforms. The operators also tried to disable security tools, though their own logs show mixed results against enterprise endpoint protection.