AI-Managed Ransomware Operation Used Phantom to Target 62 Organizations
Cybersecurity researchers have identified an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups. SOCRadar estimates that the operation targeted 62 organizations, four of which were later listed on the groups’ data leak sites. The activity was tied to an exposed server at 45.227.254[.]43 and to a framework called Phantom.
The actors are assessed to be Russian-speaking and to operate as intrusion and data-extortion specialists as well as infrastructure providers for partners in the ransomware ecosystem. Their targets were concentrated in the United States, which accounted for more than half of the organizations identified, and in industrial, manufacturing and energy sectors, followed by healthcare and pharmaceutical organizations.
An AI-executed, human-approved workflow
Phantom is described as an Autonomous Red Team Kill Chain Framework. The operators gave it victim-specific prompts, reviewed each stage, and used OpenCode with commercial models hosted through OpenRouter to carry out intrusion tasks. SOCRadar’s review of the exposed directory found 8,257 logged messages across 133 sessions.
When a model refused a request, the operator did not necessarily move to another model. Records show requests being rewritten as authorised red-team assessments. The exposed logs also indicate that AI-managed knowledge bases were used to record victim telemetry, stolen credentials and the status of active campaigns.
Phantom communicates with an external server to retrieve work, execute commands and return results. It has 18 skill modules spanning reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment and EDR fingerprinting. A related component, WormGPT-MCP, links the AI system to 32 Model Context Protocol servers and modules ranging from reconnaissance to extortion.
Edge systems and reused credentials remained central
Initial access centred on public-facing edge and remote-access systems. The operators exploited FortiClient EMS, SimpleHelp, cPanel and VPN gateways at scale. Their records listed actively exploited flaws in SimpleHelp, Fortinet FortiClient and cPanel/WHM, while other vulnerabilities affecting SonicWall SMA 1000, WordPress, LiteLLM and Drupal were staged, developed or referenced.
After gaining entry, the attackers enumerated domains, sought domain administrator privileges, harvested credentials and focused on finance, HR, legal and executive data. RevSocks reverse-SOCKS5 proxies were used for internal pivoting and to stage data for exfiltration. SOCRadar said a single reused password in one case opened access to the VPN, servers, RMM, backup and security-management platforms.
The toolkit also included Ghost C2, a set of polymorphic implants able to communicate through Cloudflare, Telegram or DNS, alongside a Cloudflare-fronted Mythic agent called QuickLine. The operators used a Quick Heal/Seqrite EDR killer that abused the Zemana driver, zam64.sys, in a bring-your-own-vulnerable-driver attack. Their own logs recorded mixed results against enterprise EDR products.
Extortion decisions were based on stolen data
Analysis of AI-authored extortion records showed a data-centred approach to ransom demands. The actors reviewed stolen financial information to estimate what a victim could pay without involving a bank or insurer, sent masked proof samples and applied pressure through scripted vishing calls and threats to contact customers, partners and regulators.
Victims were given 24 to 72 hours before stolen material could be published on leak sites, although researchers found no cryptocurrency wallet or payment records and could not determine the outcome of the demands. For businesses, the practical implication is to patch internet-facing access systems promptly, prevent credential reuse and monitor privileged remote access, because one exposed gateway or reused password can expand into a broader intrusion path.