INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors
Do Son 
Ecosystem overview | Image: STRU
At a Glance
| Malware Family | INC Ransomware (Rust-based encryptors), The Gentlemen extortion kit, Phantom framework, Ghost C2, and RevSocks |
| Threat Actor | Confirmed affiliates of INC Ransomware (MITRE G1032, GOLD IONIC) and The Gentlemen Ransomware; suspected shared tooling provider |
| Target / Victims | 62 named organizations (36 in the United States), led by manufacturing (16.1%) and healthcare (14.5%) |
| Delivery Vector | Edge device exploits targeting FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel (CVE-2026-41940) |
| Key Capabilities | AI-guided attack planning, BYOVD defense impairment, direct driver shadow copy deletion, reverse-SOCKS exfiltration |
| Sources | SOCRadar Threat Research Unit (STRU) |
TL;DR
In late September 2026, operational security mistakes by INC Ransomware affiliates exposed seven command servers holding AI session logs and custom malware. Specifically, the INC Ransomware affiliates AI workbench contained 8,257 messages across 133 OpenCode sessions and over $23,920 in commercial model spending. Furthermore, researchers recovered the Phantom framework alongside 46 custom encryptors built for six victims.
Delivery and Attribution
The investigation began when analysts found open directories on a command server that led to six additional hosts on an autonomous system run by Flyservers S.A. According to operator records, the attackers breached networks by exploiting public edge servers. Specifically, they exploited CVE-2026-35616 in FortiClient EMS across 2,236 targets, creating 108 backdoor administrator accounts and reaching 4,140 managed endpoints. Additionally, they scanned 4,922 SimpleHelp servers for CVE-2024-57727, harvesting 427 administrator passwords and impacting 242 unique IP addresses. They also claimed over 49 breaches of small hosting providers via a cPanel authentication bypass tracked as CVE-2026-41940.
Confirmed Versus Suspected Attribution
Confirmed attribution links the exposed servers directly to affiliates working with both INC Ransomware and The Gentlemen Ransomware. For instance, internal case files matched three victims listed on the INC leak portal, while another folder held a four-message extortion set signed by The Gentlemen. Meanwhile, Russian-speaking operators worked mainly between 06:00 and 14:00 UTC and used a Gmail address linked to a BreachForums account. However, suspected attribution points to a shared infrastructure provider rather than a formal merger between the two gangs. As the SOCRadar Threat Research Unit report notes, “Confidence in a formal dual-brand alliance is low, while confidence in a shared operational environment used by operators across both groups is moderate-to-high.”
Infection Chain
Rather than coding attacks by hand, the INC Ransomware affiliates ran intrusions through OpenCode connected to commercial models via OpenRouter, including Claude Opus 4.6 and Kimi K3. As the researchers explained, “The human operator directs and approves, while the AI stack (OpenCode as the interface, OpenRouter-hosted models, the Phantom skill library and a persistent knowledge base) plans reconnaissance, selects techniques, generates commands, triages stolen data and drafts reports.” Whenever a commercial model refused a malicious prompt, the operator bypassed the filter by framing the query as an authorized red-team assessment.
Phantom Framework and Encryptor Staging
Once inside a network, the attackers deployed Phantom, an autonomous attack framework with 18 skill modules whose agents masquerade as Windows Update components. They also used 32 WormGPT-labelled Model Context Protocol servers and a vulnerable Zemana driver to kill Quick Heal and Seqrite antivirus processes. For the final stage, the INC Ransomware affiliates built 46 Rust-based Windows and Linux encryptors across six targets for an October 1, 2026 launch. On Windows, the encryptor stops database services, deletes shadow copies via direct driver calls instead of vssadmin, and appends the .INC file extension.
Command-and-Control and Data-Exfiltration Behavior
To maintain stealthy access, the INC Ransomware affiliates AI infrastructure relied on three generations of polymorphic Ghost C2 implants. These implants communicated over HTTPS through Cloudflare, Telegram bots, or DNS tunnels alongside a Cloudflare-fronted Mythic agent named QuickLine. For data theft, operators established reverse SOCKS5 proxies using RevSocks and moved executive, legal, and financial files off the network using custom exfiltration tools.
AI-Driven Extortion
Across the 62 named organizations in the database, 36 were located in the United States. The attackers graded victims across five intrusion stages, ranging from 12 targets in initial reconnaissance to four publicly listed for extortion. Instead of relying solely on file encryption, the AI analyzed stolen financial records to calculate ransom demands in Monero. Next, the operators escalated pressure through executive emails, scripted vishing calls, and lookalike customer notice domains within 24 to 72 hours.
Defense and Detection Guidance
Because the INC Ransomware affiliates targeted remote management and VPN appliances first, defenders must patch FortiClient EMS, SimpleHelp, and cPanel systems immediately. Organizations should also audit FortiClient EMS for unauthorized administrator accounts and inspect endpoint scripts for unexpected changes. Furthermore, security teams should block vulnerable third-party kernel drivers like the Zemana driver to stop attackers from blinding endpoint sensors.
Because credential reuse allowed a single stolen password to unlock VPN, backup, and remote management tools in one documented breach, administrators must enforce phishing-resistant multi-factor authentication everywhere. Finally, IT teams should isolate backup servers and hypervisors from standard user segments and train staff to spot scripted vishing calls.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
