Ransomware affiliates used AI agents to automate intrusions
Researchers say ransomware affiliates used exposed infrastructure, AI agents and human approval to coordinate intrusions against dozens of organisations.
The Hacker News reports that affiliates linked to the INC and The Gentlemen ransomware groups used an exposed command-and-control environment to run an AI-assisted intrusion operation. The investigation, based on research from SOCRadar, found a framework called Phantom alongside session logs, victim records, credentials and tooling used to organise attacks against internet-facing systems. 12
How the operation worked
The exposed infrastructure reportedly logged 8,257 messages across 133 sessions. Human operators supplied victim-specific prompts and reviewed the results, while OpenCode and commercial models hosted through OpenRouter handled reconnaissance, command generation, exploit research, lateral movement and data triage. Researchers described that as an AI-executed, human-approved structure rather than an operation left entirely to autonomous software. 12
The attackers targeted edge and remote-access products including FortiClient EMS, SimpleHelp, cPanel and VPN gateways. SOCRadar said the operators used AI-managed knowledge bases to track compromised credentials, victim telemetry and campaign progress. The records also pointed to Ghost C2 implants, RevSocks reverse SOCKS5 tooling, WormGPT-labelled MCP servers and a BYOVD-based security-tool killer. 1
What the researchers found
The exposed server contained the source code for Phantom, described as an autonomous red-team kill-chain framework with modules covering reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment and EDR fingerprinting. The wider investigation linked the initial server to six more exposed systems, and SOCRadar said it identified 62 named organisations in the operators’ records, with industrial, manufacturing, energy, healthcare and pharmaceutical targets among the most affected sectors. 1
The research also described 46 INC encryptor builds prepared for six victims, alongside evidence of live encryption and extortion material associated with The Gentlemen. Those findings show the infrastructure was tied to real criminal activity, but the final outcomes of individual ransom demands remain unclear. The researchers found no recovered cryptocurrency payment record proving which demands were successful. 1
The campaign allegedly exploited several public-facing vulnerabilities, including flaws affecting SimpleHelp, Fortinet FortiClient EMS and cPanel. Other vulnerabilities were described as staged, developed or referenced rather than confirmed compromises. That distinction matters: an exposed operator record can show intent and preparation without proving that every listed tool or vulnerability was used successfully against a victim. 12
Why this matters for defenders
The story is less about an AI suddenly acting without people and more about criminals using models as an operational force multiplier. The human approval step did not make the activity harmless; it allowed a small team to maintain a persistent knowledge base, rewrite prompts when models refused requests and coordinate many technical tasks across a campaign. Defenders therefore need to watch the systems around their models as closely as the models themselves.
That means patching exposed edge services, removing reused credentials, reviewing remote-management access and treating unexplained outbound connections or reverse tunnels as possible signs of compromise. It also means logging AI-agent actions and MCP integrations wherever they are permitted, because a model-driven workflow can leave a trail across the same identity, endpoint and network systems that security teams already monitor.
Our opinion
The uncomfortable lesson is that the advantage here comes from integration, not magic. Phantom, the MCP servers, the knowledge base and the command-and-control tools turned a collection of familiar criminal techniques into a repeatable workflow. AI helped the operators move between those stages faster, but the campaign still depended on exposed services, credential reuse and weak operational security.
That makes the defensive response refreshingly concrete. Organisations do not need to wait for a perfect theory of autonomous cybercrime before acting. They can reduce the attack surface, separate privileged accounts, rotate credentials, lock down remote access and make agent activity visible now. The important shift is to treat AI tooling as part of an attacker’s infrastructure and identity chain, not as a novelty floating above the rest of the breach.