Security firm SOCRadar says it found an exposed directory at 45.227.254[.]43 that documents an AI-driven intrusion operation run by affiliates of the INC and The Gentlemen ransomware groups. The operator, assessed to be Russian-speaking, both breaks into companies and supplies infrastructure to other ransomware partners. At the centre is a framework called Phantom, which is run through OpenCode using commercial models hosted on OpenRouter. SOCRadar describes the structure as “AI-executed, human-approved”: a person writes a victim-specific prompt and reviews every step. The logs hold 8,257 messages across 133 sessions, and when a model refused a request the operator reworded it as an authorized red-team assessment rather than switching models.
According to The Hacker News, which summarised the report, the operators exploited internet-facing systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways, and used AI-managed knowledge bases to track victims, stolen credentials and campaign progress. SOCRadar says reused passwords were the main force multiplier: in one case a single password opened the VPN, servers, remote-management, backup and security platforms. About 62 organizations appear to have been targeted, four of which ended up on the INC and The Gentlemen leak sites, with the U.S. accounting for more than half and industrial, manufacturing and energy firms most common. SOCRadar says no ransom payment or wallet was recovered, so outcomes are unknown, and its logs record mixed results against enterprise EDR products.
How to check if you’re affected
Affected products are the internet-facing systems the operators’ records list. SOCRadar, as relayed by The Hacker News, marks these as actively exploited: SimpleHelp (CVE-2024-57727), Fortinet FortiClient EMS (CVE-2026-35616) and cPanel/WHM (CVE-2026-41940). It lists SonicWall SMA 1000 (CVE-2026-15409) as staged for targeting with no confirmed compromise, and WordPress (CVE-2026-63030), LiteLLM (CVE-2026-42208) and Drupal (CVE-2026-9082) as developed or referenced. The fixed versions are not given in these sources, so take them from each vendor’s advisory.
SOCRadar’s recommendations include:
- Patch FortiClient EMS and the Fortinet and SonicWall gateways, take management interfaces off the internet, and review EMS for unauthorized admin accounts or modified VPN connection scripts.
- Put MFA, IP allowlists and dedicated admin accounts on MSP and remote-management tools, and inventory tools such as SimpleHelp, MeshCentral and N-central.
- Keep backups immutable or air-gapped, turn on EDR tamper protection, and enforce vulnerable-driver blocklists.
- Watch for new privileged EMS accounts, VPN profile changes and a scheduled task named RealtekAudioSvc.