AI-Powered Ransomware Intrusions: Inside the Phantom Framework Linked to INC and The Gentlemen
The Phantom Framework supports AI-assisted cyber intrusions by enabling lateral movement, persistence, data exfiltration, and progression toward ransomware deployment, putting enterprise networks and sensitive organizational data at risk.
Summary
Cybersecurity researchers uncovered an AI-assisted intrusion ecosystem associated with affiliates of the INC and The Gentlemen ransomware groups. The operation combines automated offensive tooling, exploitation of exposed infrastructure, credential theft, lateral movement, and data-driven extortion.
The investigation identified Phantom as the central framework coordinating intrusion activities through AI agents under human supervision. Supporting tools, including WormGPT-MCP, Ghost C2, and RevSocks, enable the operators to manage reconnaissance, maintain access, move through victim networks, and collect sensitive information.
An estimated 62 organizations were targeted, with four subsequently appearing on the data leak sites associated with INC and The Gentlemen. Industrial, manufacturing, and energy organizations were among the primary targets, followed by healthcare and pharmaceutical organizations.
Background
INC and The Gentlemen are ransomware operations whose affiliates are associated with the exposed intrusion ecosystem. The investigated activity indicates that the operators perform multiple roles, including gaining access to victim networks, conducting data theft and extortion, and providing infrastructure that supports other participants in the ransomware ecosystem.
The operators are assessed to be Russian-speaking and use a human-supervised, AI-assisted operating model. Rather than relying entirely on manual execution, they provide victim-specific instructions to AI-powered tooling, review the resulting activity, and maintain records of their operations.
The exposed infrastructure also revealed how the operators manage their activities. An examination of the directory at 45.227.254[.]43 identified 8,257 messages across 133 sessions. The records included information about operational tasks and the handling of requests rejected by AI models. In some cases, operators reframed requests as authorized red-team assessments when the models refused to comply.
The operation's broader significance lies in the integration of AI agents into an established ransomware workflow. The technology supports coordinated intrusion activities, while human operators retain oversight of the tasks and decisions.
Vulnerability Details
The operators targeted internet-facing infrastructure and remote-access systems to gain initial access. The table summarizes the identified vulnerabilities alongside their CVSS severity scores and EPSS exploitation probabilities.
| CVE ID | Product | Vulnerability Type | CVSS Score | EPSS Score |
|---|---|---|---|---|
| CVE-2024-57727 | SimpleHelp | Path traversal | 7.5 (High) | 96.83% |
| CVE-2026-35616 | Fortinet FortiClient EMS | Authentication bypass | 9.8 (Critical) | 93.98% |
| CVE-2026-41940 | cPanel/WHM | Authentication bypass | 9.8 (Critical) | 98.53% |
| CVE-2026-15409 | SonicWall SMA 1000 | Server-side request forgery (SSRF) | 10.0 (Critical) | 6.79% |
| CVE-2026-63030 | WordPress | wp2shell | 9.8 (Critical) | 10.65% |
| CVE-2026-42208 | LiteLLM | SQL injection | 9.8 (Critical) | 89.42% |
| CVE-2026-9082 | Drupal | SQL injection | 9.8 (Critical) | 89.38% |
Attack Methodology
1. Exploitation of Internet-Facing Systems
The operators begin by targeting exposed edge devices, remote-access gateways, remote management software, and hosting control panels. Reported targets include FortiClient EMS, SimpleHelp, cPanel, and Ivanti, Citrix, SonicWall, and OpenVPN gateways.
Successful exploitation provides an initial foothold from which the operators can investigate the internal environment and pursue additional access.
2. AI-Orchestrated Intrusion Activities
Phantom is the central offensive framework used to coordinate the operation. It runs through OpenCode and employs commercial AI models hosted via OpenRouter. Its agent communicates with an external server to retrieve tasks, execute commands, and return results.
The framework supports 18 skill modules covering activities such as reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting.
WormGPT-MCP complements this capability through 32 Model Context Protocol servers connecting the AI system to modules spanning reconnaissance through extortion. Together, these components support a structured workflow in which human operators direct and review AI-assisted execution.
3. Credential Theft and Privilege Escalation
After gaining access, the operators enumerate the domain, collect credentials, and attempt to obtain domain administrator privileges. They prioritize financial, human resources, legal, and executive information because these records can provide both intelligence and leverage during extortion.
Credential reuse significantly increases the reach of the intrusion. In one reported incident, a single reused password provided access to VPN infrastructure, servers, remote monitoring and management systems, backups, and security management platforms.
This overlap allows attackers to expand their access across connected systems without necessarily exploiting a separate software vulnerability on each one.
4. Lateral Movement and Command and Control
RevSocks provides reverse SOCKS5 tunneling capabilities that enable the operators to pivot through compromised networks and prepare collected information for transfer.
Ghost C2 supports remote tasking and persistent communication through three generations of polymorphic implants. These implants communicate through infrastructure involving Cloudflare, Telegram, or DNS.
The operators also use QuickLine, a Cloudflare-fronted Mythic agent, alongside remote management tools and other components to support access and movement through victim environments.
5. Security Evasion and Data Collection
The operation includes a tool designed to terminate Quick Heal and Seqrite security processes by abusing the vulnerable Zemana driver zam64.sys through a bring-your-own-vulnerable-driver (BYOVD) technique.
The operators also employ loader-level evasion. Their own records indicate mixed results against enterprise EDR products, meaning these techniques did not consistently defeat all deployed security controls.
Tools such as rks3 and BackupAgent support data collection and exfiltration. The combination of credential harvesting, security evasion, and reverse tunneling enables the operators to gather sensitive information while attempting to maintain control over compromised environments.
6. Financially Targeted Data Extortion
The operators use stolen information to shape their extortion demands. Analysis of dozens of AI-authored extortion records showed that they examine victims' financial records to estimate the amount they could pay without involving a bank or insurer.
The operators then send masked samples of stolen data as evidence of compromise. Scripted voice-phishing calls and threats to contact customers, business partners, and regulators are used to increase pressure.
Victims are given 24 to 72 hours to respond before their stolen information is published on a data leak site. The investigation did not establish the final outcome of the demands, as no cryptocurrency wallet or payment records were recovered.
Impact
Lateral Movement: Attackers can use stolen credentials and remote-access tools to move across compromised networks, access additional systems, and expand the scope of compromise.
Persistence: Attackers can establish persistent access through command-and-control implants and tunneling mechanisms, allowing them to maintain access to compromised environments.
Data Exfiltration: Attackers can collect and exfiltrate sensitive financial, HR, legal, and executive records to support data theft and extortion.
Ransomware Deployment: After gaining access, escalating privileges, and collecting sensitive data, attackers can progress toward ransomware deployment. Threats to publish stolen information can increase financial and reputational damage.
Indicators of Compromise
| Indicator | Type | Context |
|---|---|---|
45.227.254[.]43 |
IP address | Exposed directory containing operational records across 133 sessions |
Visual Attack Flow
Illustrative sequence based on the reported operation; not every stage is confirmed for every targeted organization.
MITRE ATT&CK Mapping
| Technique ID | Tactic | Technique |
|---|---|---|
| T1190 | Initial Access | Exploit Public-Facing Application |
| T1078 | Defense Evasion | Valid Accounts |
| T1021.002 | Lateral Movement | Remote Services: SMB/Windows Admin Shares |
| T1055 | Defense Evasion | Process Injection |
| T1562.001 | Defense Evasion | Impair Defenses: Disable or Modify Tools |
| T1041 | Exfiltration | Exfiltration Over C2 Channel |
| T1486 | Impact | Data Encrypted for Impact |
| T1657 | Impact | Financial Theft |
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
