SOCRadar's Threat Research Unit said on 20 October 2026 that it uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen ransomware groups. A single publicly accessible command-and-control server exposed the operators' AI session databases, their central knowledge base and the source code of Phantom, which SOCRadar describes as a new 'Autonomous Red Team Kill Chain Framework'; files on that server led SOCRadar to six more exposed adversary-controlled servers, mostly hosted on AS267784 (Flyservers S.A.).

SOCRadar assesses with high confidence that the operation is 'AI-executed, human-approved': a human operator started each campaign with a victim-specific prompt and approved every step, while intrusions ran through OpenCode with OpenRouter-hosted commercial models.

It analysed 8,257 messages across 133 OpenCode sessions, says 'WormGPT' was only a persona prompt, and says that when models refused, the operator rewrote requests as 'Authorized Red Team Assessment Request' templates instead of switching models. Recorded AI API spending exceeded $23,920. SOCRadar describes the operators as Russian-speaking and most active between 06:00 and 14:00 UTC.

According to the operators' own records, which SOCRadar says are not independently verified, they exploited FortiClient EMS (CVE-2026-35616; 2,236 targets, 108 created admin accounts and 4,140 managed endpoints), SimpleHelp (CVE-2024-57727; 242 unique IP addresses impacted) and cPanel/WHM (CVE-2026-41940; 49+ claimed breaches of small hosting providers), and also evaluated Ivanti, Citrix, SonicWall and OpenVPN gateways.

SOCRadar says credential reuse was the main force multiplier, and that security products were impaired with a bring-your-own-vulnerable-driver killer abusing the Zemana driver against Quick Heal/Seqrite. Recovered tooling includes Phantom (18 skill modules), 32 'WormGPT-MCP' Model Context Protocol servers, the Ghost C2 implants, the RevSocks reverse SOCKS5 framework and the QuickLine Mythic agent.

SOCRadar says the servers held 46 custom INC encryptor builds for six victims, packed for a deployment wave on 1 October 2026 (deployment against those targets is unconfirmed), and a 30 September screenshot showing the encryptor running on a victim workstation.

It counts 62 named organisations, 36 of them in the United States, led by industrial/manufacturing (16.1%) and healthcare (14.5%). Primary: SOCRadar.

Updated 23 Oct 2026: The Hacker News reported the research. (source: The Hacker News)