Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Summary: Researchers found an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups, built around a framework called Phantom that executes intrusions through OpenCode with OpenRouter-hosted commercial models while a human operator supplies victim-specific prompts and approves each step. An exposed directory at 45.227.254[.]43 logged 8,257 messages across 133 sessions, and SOCRadar estimates 62 organizations were targeted, with four listed on the groups' data leak sites and more than 50% of targets in the U.S.
What's compelling: In one recorded case a single reused password unlocked the VPN, servers, RMM, backup and security management platforms at once, and the operators' own logs show mixed results against enterprise EDRs even as they ran a BYOVD killer against security products.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026