Cybersecurity researchers have uncovered an exposed server that they say reveals how affiliates of the INC and The Gentlemen ransomware groups used artificial intelligence to help carry out network intrusions. The findings come from SOCRadar, which analyzed an open directory at 45.227.254[.]43 and found 8,257 logged messages across 133 sessions.
The operators are assessed to be Russian-speaking and act as both intruders and infrastructure providers for other partners. According to SOCRadar, they exploited internet-facing edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways, and kept AI-managed records tracking victims, stolen credentials and campaign progress.
The setup relied on what the researchers describe as an AI-executed, human-approved structure: a person supplies a victim-specific prompt and reviews each step, while the intrusions run through OpenCode using commercial models hosted by OpenRouter. When models refused requests, the operator reportedly rewrote them as authorized red-team assessments rather than switching tools.
SOCRadar lists several vulnerabilities the operators recorded as exploited, including a SimpleHelp path traversal flaw, a Fortinet FortiClient authentication bypass and a cPanel/WHM authentication bypass, alongside others staged or developed but not confirmed as compromised. After gaining access, the operators reportedly enumerated domains, escalated to domain admin where possible, harvested credentials, prioritized finance, HR, legal and executive files, and collected data over reverse SOCKS tunnels.
The toolkit included Phantom, described as an AI-powered penetration-testing framework with 18 skill modules; WormGPT-MCP, a set of 32 Model Context Protocol servers; Ghost C2, three generations of implants communicating over Cloudflare, Telegram or DNS; and RevSocks, a reverse SOCKS5 framework for pivoting. Other tools included a Cloudflare-fronted Mythic agent called QuickLine, an EDR killer abusing the Zemana driver, and exfiltration programs rks3 and BackupAgent.
SOCRadar estimates 62 organizations were targeted, with four listed on the groups' data leak sites. The U.S. accounted for more than half of targets, and industrial, manufacturing and energy sectors were hit most, followed by healthcare and pharmaceuticals. Ransom demands reportedly followed analysis of stolen financials, with 24-72 hour deadlines, though no wallet or payment record was recovered, leaving outcomes unknown.
Source: The Hackers News