Ransomware Ecosystem — Exposed Infrastructure Reveals Intrusion Operations Orchestrated by AI Agents

Publication date: October 23, 2026
Category: Ransomware / Cybercrime

Introduction

Cybersecurity researchers have uncovered an artificial intelligence (AI)-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. At the center of this operation is an “Autonomous Red Team Kill Chain Framework” known as Phantom, designed to automate various stages of the intrusion life cycle. Assessed to be of Russian-speaking origin, the threat actor functions concurrently as an extortion operator and an infrastructure provider supporting multiple partners across the cybercrime ecosystem. The large-scale exploitation of edge and remote-access systems—including FortiClient EMS, SimpleHelp, and cPanel—has enabled the attackers to maintain AI-managed knowledge bases to track victims, harvested credentials, and campaign milestones.

What is the AI-Driven Automated Attack Ecosystem? (General Analysis)

The campaign is defined by its “AI-executed, human-approved operating structure,” where a human operator provides victim-specific prompts and reviews each step, while the actual execution is performed through advanced tools connected to commercial models hosted on OpenRouter.

An examination of an exposed directory (45.227.254[.]43) revealed over 8,200 logged messages across numerous sessions. The framework utilizes sophisticated mechanisms, including an AI-powered offensive security framework and context control modules (such as WormGPT-MCP), to execute reconnaissance, binary reverse engineering, and exploit research.

The impact on affected systems is critical, as operators leverage severe vulnerabilities in network gateways and management servers featured in active exploitation catalogs, highlighting multiple high-severity CVEs:

  • CVE-2024-57727 (SimpleHelp): High severity (7.5 CVSS v3.1), classified under CWE-22 (Path Traversal). Listed in the CISA KEV catalog.
  • CVE-2026-35616 (Fortinet FortiClient EMS): Critical severity (9.8 CVSS v3.1), classified under CWE-284 (Improper Access Control). Listed in the CISA KEV catalog.
  • CVE-2026-41940 (cPanel / WHM): Critical severity (9.3 CVSS v4.0), classified under CWE-306 (Missing Authentication for Critical Function). Listed in the CISA KEV catalog.
  • CVE-2026-15409 (SonicWall SMA 1000): Critical severity (10.0 CVSS v3.1), classified under CWE-918 (Server-Side Request Forgery - SSRF). Listed in the CISA KEV catalog.
  • CVE-2026-63030 (WordPress): Critical severity (9.8 CVSS v3.1), classified under CWE-436 (Interpretation Conflict). Listed in the CISA KEV catalog.
  • CVE-2026-42208 (LiteLLM): Critical severity (9.3 CVSS v4.0), classified under CWE-89 (SQL Injection). Listed in the CISA KEV catalog.
  • CVE-2026-9082 (Drupal Core): Critical severity (9.8 CVSS v3.1), classified under CWE-89 (SQL Injection). Listed in the CISA KEV catalog.

How Does It Work? (Technical Analysis)

The campaign’s modus operandi follows a structured attack chain combining algorithmic automation with traditional post-exploitation techniques:

  • Initial Access and Edge Exploitation: Attackers exploit known vulnerabilities in internet-facing edge devices at scale, achieving authentication bypasses, access control circumvention, or arbitrary file reads of configuration data and secrets.
  • Lateral Movement and Persistence: Once inside the network, operators utilize the RevSocks framework to establish reverse SOCKS5 tunnels and pivot internally. They also deploy polymorphic C2 variants (Ghost C2) communicating via Cloudflare, Telegram, or DNS to maintain persistent beacons.
  • Defense Evasion and Credential Harvesting: Attackers leverage credential reuse as a primary force multiplier. To neutralize security controls, they employ loader-level evasion techniques and Bring Your Own Vulnerable Driver (BYOVD) attacks utilizing a legitimate vulnerable driver (zam64.sys) to disable EDR solutions.
  • Exfiltration and Targeted Extortion: Log analysis reveals a data-centric approach targeting financial, HR, and legal files. Extortion is driven by automated analysis of the victim’s payment capacity, supplemented by scripted vishing calls and threats of publication on leak sites if a 24-72 hour ultimatum is unmet.

Affected Systems / Environments

The exposed infrastructure and identified vectors directly impact organizations across industrial, manufacturing, energy, healthcare, and pharmaceutical sectors, with US-based entities accounting for the majority of targets.

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2024-57727 CWE-22 (Path Traversal) Secret Exfiltration 7.5 (High) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2026-35616 CWE-284 (Access Control) Code Execution 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-41940 CWE-306 (Missing Auth) Authentication Bypass 9.3 (Critical) AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-15409 CWE-918 (SSRF) Malicious Requests 10.0 (Critical) AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-63030 CWE-436 (Interpretation) RCE via SQLi 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-42208 CWE-89 (SQL Injection) Unauthorized DB Access 9.3 (Critical) AV:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-9082 CWE-89 (SQL Injection) Core SQL Injection 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Immediately apply official patches provided by vendors for each affected product (SimpleHelp, FortiClient EMS, cPanel/WHM, SonicWall, WordPress, LiteLLM, and Drupal).
  • Audit and restrict the exposure of management interfaces and VPN gateways directly to the Internet, enforcing robust multi-factor authentication (MFA) and network segmentation.
  • Monitor kernel integrity and driver control policies to mitigate BYOVD-style attacks.

Detection

Incident response teams should actively hunt for Indicators of Compromise (IoCs) associated with autonomous agent infrastructure and reverse tunneling tools:

The utilization of integrated AI agents with offensive frameworks like Phantom and reverse proxy gateways like RevSocks demonstrates a shift toward advanced offensive automation, requiring strict monitoring of non-standard outbound connections and anomalous patterns in exposed directories.

  • Network Monitoring: Inspect traffic destined for endpoints associated with reverse SOCKS5 tunnels and HTTP beaconing patterns targeting Cloudflare/Telegram services.
  • Log Analysis: Review access logs on edge servers for anomalous HTTP requests attempting authentication bypasses or path traversal traversals.

Wrapping Up

The adoption of autonomous AI agents by ransomware affiliates such as INC and The Gentlemen marks a concerning evolution in the industrialization of cybercrime. The ability to automate the kill chain via frameworks like Phantom, combined with the mass exploitation of critical vulnerabilities in edge systems, highlights the urgent need for a proactive patching posture and deep visibility into exposed infrastructure.

References