Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Summary

An exposed intrusion ecosystem reportedly connected ransomware affiliates associated with INC and The Gentlemen to AI-assisted operational execution. The operator was assessed as Russian-speaking and acted both as an intrusion/data-extortion operator and as an infrastructure provider for ransomware partners. Its central framework, Phantom, supported an explicitly human-approved workflow: operators supplied victim-specific prompts and reviewed steps, while OpenCode and OpenRouter-hosted commercial models executed intrusion tasks. The exposed records contained 8,257 messages across 133 sessions.^[0]

The reported intrusion lifecycle began with exploitation of internet-facing edge and remote-access systems, followed by domain enumeration, privilege escalation where possible, credential harvesting, lateral movement, persistence, and data theft. Operator records identified active exploitation of SimpleHelp CVE-2024-57727, FortiClient CVE-2026-35616, and cPanel/WHM CVE-2026-41940. RevSocks supported internal pivoting and data collection, Ghost C2 supplied persistent implants, and a Zemana-driver BYOVD tool and loader-level evasion were used to impair security products, with mixed EDR results.^[0]

The operation reportedly targeted an estimated 62 organizations; four subsequently appeared on INC or The Gentlemen leak sites. More than half of the targets were in the United States, with industrial, manufacturing, and energy organizations most prominent. Extortion records described using stolen financial information to size demands, supplying masked proof samples, and applying pressure through vishing and threatened stakeholder notifications. Targeting should not be equated with confirmed compromise, and the report did not establish final payment outcomes.^[0]

The campaign findings in the supplied evidence rest on The Hacker News account of SOCRadar's investigation. The separately supplied Akamai article explains a WordPress vulnerability chain, not the ransomware operation. In particular, the campaign account classifies its WordPress capability as developed, rather than confirmed exploited; the technical background therefore must not be read as evidence of additional campaign compromises.^[0][16]

Attack chain

1. 1. Human-directed AI tasking: The reported composite workflow began with a human supplying a victim-specific prompt and reviewing operational steps. Phantom supported execution through OpenCode and OpenRouter-hosted models; AI-managed knowledge bases tracked victims, compromised credentials, and campaign progress. When models refused requests, operators reframed them as authorized red-team assessments. The supporting toolkit included Phantom's 18 skill modules and WormGPT-MCP's 32 MCP servers.^[0]
2. 2. Exploitation of exposed access systems: Initial access was obtained by exploiting public-facing edge and remote-access services at scale. The report identifies SimpleHelp path traversal, FortiClient authentication bypass, and cPanel/WHM authentication bypass as actively exploited. It separately identifies SonicWall targeting as staged without confirmed compromise and other capabilities as developed or referenced.^[0]
3. 3. Domain discovery, privilege escalation, and credential harvesting: After entry, operators enumerated the domain, sought domain-administrator privileges where possible, and harvested credentials with stealer tooling. Credential reuse expanded access: one recorded password worked across VPN, servers, RMM, backup, and security-management platforms.^[0]
4. 4. Internal pivoting, persistence, and defense impairment: The operators moved laterally and established persistence. RevSocks provided reverse-SOCKS5 pivoting, while Ghost C2 variants supported task execution and persistent beacons using Cloudflare, Telegram, or DNS communications. The toolkit also included the Cloudflare-fronted QuickLine Mythic agent. Security-product impairment used a Zemana-driver BYOVD tool and loader-level evasion, although the records showed mixed effectiveness against enterprise EDR.^[0]
5. 5. High-value collection and exfiltration: The operators prioritized finance, HR, legal, and executive material and collected data over reverse-SOCKS tunnels. Their toolkit included rks3 and BackupAgent for exfiltration. Stolen financial records subsequently informed assessments of how much victims could pay.^[0]
6. 6. Ransomware escalation and data-extortion pressure: The reported lifecycle escalated toward ransomware deployment. Extortion records separately described AI-authored demands calibrated to victim finances, masked proof samples, scripted vishing calls, and threats to notify customers, partners, and regulators. The evidence does not establish that every targeted organization reached ransomware deployment.^[0]
7. 7. Deadline and leak-site publication: The report describes 24–72-hour payment deadlines followed by publication of stolen data when victims did not pay. Four of the estimated 62 targets appeared on INC or The Gentlemen leak sites, but recovered records did not establish final ransom-payment outcomes.^[0]

Disclosure timeline

Actor profile

INC and The Gentlemen

The report links the exposed operation to affiliates associated with these ransomware groups, rather than naming a distinct affiliate identity. The operator was assessed as Russian-speaking and combined intrusion and data-extortion activity with infrastructure provision for multiple ransomware partners. Four targeted organizations appeared on the groups' leak sites. The evidence supports affiliate-level association; it does not establish a nationality or a single command structure governing both ransomware groups.^[0]

How it works

The campaign account identifies three actively exploited access weaknesses: SimpleHelp path traversal under CVE-2024-57727, FortiClient authentication bypass under CVE-2026-35616, and cPanel/WHM authentication bypass under CVE-2026-41940. These weaknesses supported the reported initial-access pattern against exposed services, but the supplied campaign text does not provide exploit requests, payload details, or version-specific prerequisites.^[0]

For the separately documented WordPress chain, the REST Batch API can validate a request against one route while executing it against another. This handler-alignment flaw bypasses expected parameter sanitization. Combined with a post-listing parameter that does not sanitize non-array input before database processing, it enables unauthenticated SQL injection. The batch endpoint requires neither credentials nor user interaction.^[16]

Akamai describes escalating the WordPress injection through object caching and post-processing behavior to manipulate stored state, assume an administrative context, and provision a privileged account. Installing a malicious plug-in then enables arbitrary code execution. This explains the CVE-2026-63030/CVE-2026-60137 chain as technical background; the campaign report only describes its WordPress capability as developed, not confirmed used against victims.^[0][16]

The operation's defense-impairment toolkit included a Quick Heal/Seqrite EDR killer that abused the Zemana driver zam64.sys in a bring-your-own-vulnerable-driver attack. Loader-level evasion was also reported. The supplied account records mixed EDR results, so the presence of these capabilities does not establish that endpoint defenses were consistently disabled.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• The reported AI integration automated execution under human approval; it was not evidence of an unsupervised, self-directed intrusion system. Operators still selected victims, reviewed steps, and rewrote refused prompts.^[0]
• The principal defensive pressure points remained exposed access infrastructure, reused credentials, internal proxying, security-product impairment, and theft of high-value business data despite the AI-assisted orchestration.^[0]
• Keep capability status separate from exploitation status: three listed vulnerabilities were reported actively exploited, while SonicWall targeting was staged and the WordPress, LiteLLM, and Drupal capabilities were developed or referenced.^[0]
• The estimated 62 targets, four leak-site listings, and unknown payment outcomes describe different levels of evidence. They do not establish 62 successful compromises or a measured ransom-payment success rate.^[0]
• The separately supplied WordPress research supports concrete exploit mechanics and mitigation options, but does not independently corroborate the ransomware operation's attribution, scale, or outcomes.^[0][16]

Defensive actions

• Prioritize exposure and remediation review for SimpleHelp CVE-2024-57727, FortiClient CVE-2026-35616, and cPanel/WHM CVE-2026-41940; examine affected access systems for evidence of prior exploitation.: These are the three vulnerabilities specifically identified as actively exploited in operator records. The supplied evidence does not provide fixed release numbers, so it cannot support a version-specific upgrade prescription.^[0]
• During incident scoping, check compromised credentials for reuse across VPN, servers, RMM, backup, and security-management systems, and revoke or replace exposed credentials across those systems.: Credential reuse was a reported force multiplier; one password provided access across all five management and access categories. Limiting the review to the original entry system would miss the documented cross-platform exposure.^[0]
• Hunt for RevSocks reverse-SOCKS activity, Ghost C2 persistence and tasking, and the QuickLine Mythic agent; correlate suspicious Cloudflare, Telegram, or DNS communications with endpoint activity rather than treating those shared services alone as malicious.: The toolkit used reverse-SOCKS pivoting and persistent implants over these communication channels. The report supplies tool and channel associations, but no campaign-specific domains or implant hashes.^[0]
• Investigate unexpected zam64.sys deployment or loading and associated security-product interruptions; validate endpoint-protection health on suspected hosts.: The reported EDR-killer capability abused this Zemana driver, while loader-level evasion supplied another impairment path. Mixed results in the operator logs mean defenders should verify outcomes rather than assume either complete protection or complete disablement.^[0]
• Scope suspected data theft around finance, HR, legal, and executive repositories, and review evidence of reverse-SOCKS transfers or unauthorized rks3 and BackupAgent execution.: These repositories and tools align with the operation's reported collection priorities and exfiltration methods. Stolen financial information also supported tailored extortion demands.^[0]
• Include scripted vishing, masked data samples, stakeholder-notification threats, and short payment deadlines in incident-specific extortion triage.: The reported extortion workflow used these pressure mechanisms and 24–72-hour deadlines. Such communications can help connect data-theft findings with the monetization stage without assuming that a payment occurred.^[0]
• For exposed WordPress deployments, verify application of the upstream fixes for CVE-2026-63030 and CVE-2026-60137 and assess SQL-injection coverage at the REST Batch API entry point. Akamai users can evaluate the reported Adaptive Security Engine protections and chain-specific Rapid Rule.: Akamai states that patches are available and that blocking the initial SQL injection disrupts the escalation chain. This is a preventive action for a developed campaign capability, not evidence of confirmed WordPress compromise by the affiliates.^[0][16]