Ransomware Crews Left Their AI Playbook Exposed: What INC and The Gentlemen Affiliates Revealed

SOCRadar's Threat Research Unit (STRU) has uncovered an AI-driven intrusion operation run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A publicly accessible command-and-control server exposed the operators' AI session databases, their central knowledge base and the source code of Phantom, described as an "Autonomous Red Team Kill Chain Framework". Credentials and logs on that server led researchers to six more exposed servers, most hosted on AS267784 (Flyservers S.A.).

According to STRU, the operators attacked edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways. AI-managed knowledge bases tracked victims, stolen credentials and campaign progress. The servers also held 46 custom INC encryptor builds staged for an October 1, 2026 deployment, evidence of a live victim encryption, and a branded extortion package for a case listed by The Gentlemen. STRU assesses with high confidence that the model is AI-executed and human-approved: a person directs and approves, while the AI plans reconnaissance, selects techniques, generates commands, triages stolen data and drafts reports. Researchers analysed 8,257 messages across 133 sessions, and recorded AI spending exceeds $23,000.

The campaign came to light in late September 2026 after operational security failures left source code, credentials and session logs exposed. The reliance on AI memory became the operators' weakness, because the knowledge bases and logs form a complete evidence trail. This is only the opening of SOCRadar's findings; the full technical analysis is in its whitepaper.