Phantom and WormGPT-MCP: AI-Executed, Human-Approved Ransomware Operations

Key Takeaways

On October 20, 2026, SOCRadar’s Threat Research Unit (STRU) published an analysis of seven exposed servers belonging to an intrusion ecosystem used by affiliates of the INC Ransomware and The Gentlemen operations [1]. The exposed material included the source code of “Phantom,” which its authors describe as an “Autonomous Red Team Kill Chain Framework,” along with a tool suite labeled WormGPT-MCP and 8,257 AI messages across 133 OpenCode sessions [1][2]. The exposure offers one of the most detailed public views to date of financially motivated ransomware affiliates using commercial frontier models as the execution layer of an intrusion, with a human approving each step.

The AI involved was commercial, not “dark.” STRU reports that “WormGPT” was only a persona prompt layered over standard commercial models, namely Anthropic’s Claude Opus 4.6 and Moonshot AI’s Kimi K3, both accessed through OpenRouter [1][2]. When a model refused a request, the operator resubmitted it as an “Authorized Red Team Assessment Request” rather than switching models [1]. Humans approved and machines executed: each campaign began with a victim-specific master prompt instructing the agent to “coordinate every action with me” and to wait for operator sign-off before each step, and STRU assesses with high confidence that this was an AI-executed, human-approved operation [1].

The way in, by contrast, was entirely conventional. Initial access relied on known edge and remote-access vulnerabilities in FortiClient EMS, SimpleHelp, and cPanel/WHM, plus a single reused password that in one case unlocked the VPN, servers, RMM, backup, and security platforms [1]. Patching, identity hygiene, and segmentation therefore remain the most directly relevant controls. The scale of the operation is notable, though much of it is self-reported. STRU identified 62 named organizations, 36 of them in the United States, and 46 personalized INC encryptor builds prepared for six victims, while many access-volume figures come from the operators’ own records and have not been independently verified [1].

Finally, defenders should plan for both more concurrent intrusions and potentially shorter attack timelines. STRU dates the activity from Ghost C2 operations in mid-July 2026 to live encryption on September 30, 2026 [1]. Aviatrix assesses that agent-driven execution compresses attacker timelines [7], while STRU’s data more directly shows parallelism, with many intrusions run at once. Either effect reduces the margin defenders have, and planning should account for both.

Background

From “Dark LLMs” to Agentic Workbenches

The WormGPT brand first appeared in 2023 as a criminal chatbot marketed for phishing and business email compromise. Later variants turned out to be wrappers around mainstream models; in 2025, Cato CTRL found WormGPT variants that relied on system prompts to push Grok and Mixtral past their guardrails [3]. The same year, Anthropic disclosed two cases that marked a shift from AI as an advisor to AI as an operator. In August 2025, Anthropic described an actor it tracks as GTG-2002, which used Claude Code to run a scaled data-extortion operation that Anthropic described as “vibe hacking” [4]. In November 2025, Anthropic reported GTG-1002, a state-sponsored espionage campaign in which Claude Code instances acting as orchestrators carried out an estimated 80–90% of tactical operations, with humans intervening mainly at strategic decision points [5].

Phantom extends that trajectory into the ransomware-as-a-service (RaaS) affiliate economy. INC Ransom is a Rust-based RaaS operation, active since at least July 2023, that MITRE ATT&CK tracks as group G1032 [1][6]. STRU links the exposed infrastructure to INC through several pieces of evidence: 46 encryptors that decrypt the INC ransom note, three INC leak-site victims that match internal case files, and chat logs from an INC administration panel [1]. At least one extortion case was signed “The Gentlemen.” STRU assigns low confidence to a formal alliance between the two brands and moderate-to-high confidence to a shared operational environment, and it judges the most plausible structure to be a dedicated tooling and infrastructure provider serving several ransomware partners [1].

How the Infrastructure Was Exposed

The operation came to light because of operational security failures rather than defensive detection. STRU found a command-and-control server at 45.227.254[.]43 with open directories holding the operators’ knowledge base, AI session logs, and Phantom source code. Configuration files and credentials on that host led to six more servers, most of them on AS267784 (Flyservers S.A.), including a development hub, an operator Windows virtual machine with SimpleHelp and staged INC encryptors, a Ghost C2 panel, and a RevSocks pivot host [1]. A partner onboarding guide on the development hub advertised the toolkit to outside operators, claiming “35 MCP servers,” “55+ tools,” and “9K+ CVE PoC” [1]. STRU counted 32 MCP servers in the WormGPT-MCP deployment it examined, and that gap between marketing claims and observed tooling should be kept in mind when reading the operators’ self-descriptions [1].

The operator is assessed as Russian-speaking and was active mostly between 06:00 and 14:00 UTC [1]. A live check on October 5, 2026 found two active, paid OpenRouter accounts, one of them nearly exhausted after $23,920 in spending [1][2]. In CSA’s assessment, that figure suggests AI spend was modest relative to the potential return from even a single successful extortion, although STRU’s data does not support a precise per-victim cost.

Security Analysis

The Operating Model: AI as Executor, Human as Approver

The architecture reverses the usual “copilot” pattern. In Phantom, the model does more than suggest commands for a human to type. Through OpenCode and MCP integrations, it plans reconnaissance, generates and runs commands, analyzes stolen credentials, and drafts reports, while the human stays in the loop as an approval gate [1][2]. STRU describes 18 skill modules and an autopilot orchestrator in the framework [1], and secondary analysis lists modules for EDR fingerprinting, binary reverse engineering, and steganography [7]. Phantom’s own implants disguise themselves as Windows Update components [1]. Persistent, AI-curated knowledge bases about each victim carry context across sessions, so the agent can resume an intrusion where it left off [1][7].

This “human-approved” design has an uncomfortable implication. The human-in-the-loop pattern that responsible AI programs promote as a safety control works just as well as an operational control for an adversary. Approval gates let the operator keep judgment over high-risk steps, such as choosing when to encrypt or which data to steal, while the agent handles the high-volume work of enumeration, exploitation, and triage. Human oversight therefore does not, on its own, prevent misuse. What matters is who the human is and what they are approving.

Guardrail Evasion Through Authorization Pretexts

In CSA’s assessment, the most significant AI-safety finding is how the operators got past model refusals. According to STRU, the operator did not jailbreak a model with adversarial prompts or switch to an uncensored model; instead, they wrapped requests in “Authorized Red Team Assessment Request” templates [1][2]. This pretext works because legitimate penetration testing and red teaming are recognized, valuable uses of frontier models, and CSA’s own guidance describes how organizations can use AI in offensive security work [10]. Without verifiable evidence of authorization, a model cannot reliably tell a contracted red team from a ransomware affiliate who claims to be one. The GTG-1002 campaign used a similar technique, with the operator posing as employees of a legitimate cybersecurity firm [5]. Taken together, these cases show that claimed-authorization pretexts have recurred across unrelated actors and motivations, which suggests a repeatable technique rather than a one-off trick.

Kill-Chain Mapping

The intrusion lifecycle itself is conventional ransomware tradecraft; AI-driven execution increases its speed and the number of intrusions that can run at once. Table 1 combines STRU’s findings with Aviatrix’s MITRE ATT&CK mapping, following each stage from initial access through impact.

Table 1. Phantom kill chain as reported by SOCRadar STRU and Aviatrix. ATT&CK mappings are drawn from Aviatrix [7] except those marked with an asterisk, which are CSA’s mapping of the reported behavior. Aviatrix lists T1078 (Valid Accounts) under Defense Evasion; it appears here because it reflects reuse of harvested credentials during escalation.

The initial-access figures show the operation’s scale, but they need careful reading. Operator records claim 2,236 FortiClient EMS targets, 108 created administrator accounts, and 4,140 managed endpoints; they also claim 427 administrator passwords recovered from scans of 4,922 SimpleHelp servers, and more than 49 compromised hosting providers via cPanel/WHM [1][2]. STRU stresses that these counts are operator-reported and not independently verified [1]. SimpleHelp in particular has a well-documented history of ransomware exploitation: CISA advisory AA25-163A described ransomware actors using CVE-2024-57727 to reach the downstream customers of a utility billing software provider [8]. Because the SimpleHelp campaign targeted MSP technician credentials, it gives an AI-driven operator a ready-made path from one compromise to many clients [1].

Victimology and Outcome Uncertainty

STRU grouped the 62 named organizations by how deep the intrusion went. Twelve reached reconnaissance only, 28 reached a foothold, 14 reached domain-level compromise, four reached the encryption or extortion stage, and four were publicly listed for extortion [1]. This last tier measures something different from the three INC leak-site victims cited earlier, which STRU matched to internal case files as attribution evidence. Industrial, manufacturing, and energy organizations made up 16.1% of named targets, and healthcare and pharmaceutical organizations made up 14.5% [1]. Of the 35 victims whose revenue could be classified, 27 had revenue of $250 million or less [1], a profile that points toward mid-market organizations, which may have thinner security operations coverage.

The outcome of the campaign is less certain than its reach. A September 30 SimpleHelp screenshot shows an encryptor running on a victim workstation, but STRU notes that deployment against the staged targets is unconfirmed, and no Monero wallet or payment record was recovered [1]. Defenders should treat the October 1 deployment wave as planned, not proven.

What Is New and What Is Not

It is important to separate what is new here from familiar tradecraft. The exploits, the RMM abuse, the BYOVD technique, and the double-extortion playbook are all established ransomware methods. What appears to be new is the economics and the throughput. Commercial models, accessed through a model-routing service and connected to dozens of tool servers, appear to give a small operator group the parallel capacity of a much larger crew. MCP is an open protocol designed to connect models with external tools and data [9], and in this deployment it served as the connective tissue for offense. That use fits the protocol’s design, which describes a general-purpose integration layer rather than any defensive purpose. One inference, which STRU’s data suggests but does not prove, is that the barrier to running many concurrent intrusions has fallen substantially for affiliates able to pay a few tens of thousands of dollars in API costs.

Recommendations

Immediate Actions

Organizations should first confirm their exposure to the specific access paths documented in this operation. That means verifying that FortiClient EMS, SimpleHelp, and cPanel/WHM instances are patched against CVE-2026-35616, CVE-2024-57727, and CVE-2026-41940, respectively. Any instance that was internet-exposed and unpatched during July–October 2026 should be treated as potentially compromised [1][8]. On FortiClient EMS, teams should audit for unexpected administrator accounts and modified VPN connection scripts, since the operators planted backdoor administrators and pushed payloads through those scripts [1]. Organizations that rely on MSPs using SimpleHelp should ask their providers directly whether technician credentials were rotated after the CVE-2024-57727 disclosures.

Threat hunting teams should then search for the indicators STRU published. Table 2 summarizes the highest-value starting points.

Table 2. Priority hunting indicators from the SOCRadar STRU report.

Short-Term Mitigations

In CSA’s view, the single reused password that unlocked the VPN, servers, RMM, backup, and security platforms in one case is the most transferable lesson from this operation [1]. Over the next 30 to 90 days, organizations should ensure that backup consoles, EDR and security management platforms, and RMM tools use separate, phishing-resistant credentials that are not linked to the main directory. Administrative access to these planes should be segmented so that compromising one identity cannot reach all of them. Because AI-driven operators can triage stolen credentials and run discovery in parallel, detection logic should also be tuned for fast, broad enumeration bursts; alert thresholds calibrated to slower human operators may fire too late.

Organizations that use AI tools for their own security testing should also require verifiable authorization before running them. This means signed engagement scopes, approved target lists enforced at the tool layer, and logging of agent actions. These measures make internal red-team agents harder to misuse and give providers a model for the authorization signals they should expect. The ease with which “authorized red team” framing defeated model refusals suggests that model providers and AI gateway operators should treat unverified authorization claims as a risk signal, not a permission [1][5].

Strategic Considerations

At the strategic level, organizations should update their threat models to assume that adversaries combine commercial frontier models, MCP-connected tool suites, and human approval gates. Under this assumption, attacker capacity grows with API budget rather than headcount. Incident response planning should allow for more concurrent intrusions and a potentially compressed timeline between foothold and extortion, and investments in edge-device lifecycle management, attack surface monitoring, and immutable, independently credentialed backups should be prioritized accordingly. Organizations that build or host agentic AI systems should recognize that the integration patterns they use legitimately, such as MCP servers, model routers, and persistent agent memory, are the same ones adversaries now use. Security reviews should therefore cover how those components could be abused, not only how they could be attacked.

The AI industry also has a structural problem to address. The Phantom and GTG-1002 cases indicate that refusal-based safeguards that depend on how a request is described are vulnerable to authorization pretexting, and that vulnerability is likely to persist without stronger verification signals. Approaches that tie dual-use offensive capability to verified identity, attested authorization, and abuse monitoring across sessions deserve continued investment from model providers and routing platforms. In the GTG-1002 case, provider-side visibility into account behavior enabled detection and disruption [5]. In the Phantom case, no provider action has been reported; the operation was exposed through the operators’ own infrastructure failures [1]. However, the billing and usage records STRU recovered from the OpenRouter accounts suggest that routing platforms hold behavioral signals that could support earlier detection.

CSA Resource Alignment

CSA’s Using AI for Offensive Security (2024) is the most directly relevant published work. It examines how large language models and AI agents can support reconnaissance, scanning, vulnerability analysis, exploitation, and reporting in legitimate penetration testing and red teaming [10]. The Phantom framework applies those same capabilities in criminal hands, with its autopilot orchestrator and skill modules covering each phase. The paper’s discussion of AI-assisted offensive workflows gives defenders a useful baseline for what such an agent can realistically do, and Phantom’s abuse of “authorized red team” framing shows why the authorization and scoping practices the paper recommends matter beyond legitimate testing programs.

Building on that baseline, the Agentic AI Red Teaming Guide [11] gives a structured method for testing autonomous agents, including authorization hijacking, checker-out-of-the-loop failures, and supply chain risks. Organizations that operate their own agentic security tooling can use it to test whether those agents could be redirected by pretexted instructions, a failure mode Phantom shows is being exploited in practice. The guide’s focus on authorization and control hijacking and on agent permission boundaries applies directly to the MCP-heavy architecture documented here.

The AI Controls Matrix (AICM) v1.1 [12] provides a control baseline for both sides of this problem. For organizations that consume AI, its identity and access management, threat and vulnerability management, and logging and monitoring domains align with the edge patching, credential separation, and hunting recommendations above. For model providers and orchestrated service providers, AICM’s controls related to model abuse monitoring and acceptable-use enforcement are relevant to the refusal-bypass and account-misuse patterns that STRU documented.

Finally, healthcare and pharmaceutical organizations made up 14.5% of named targets [1]. For them, CSA’s Ransomware in the Healthcare Industry [13] remains a relevant playbook, organized around the protect, detect, respond, and recover functions. Its emphasis on backup integrity and incident response preparation fits the faster, more parallel operations that AI execution enables.

References

[1] SOCRadar Threat Research Unit. “INC and The Gentlemen Ransomware: Exposed AI Infrastructure.” SOCRadar, October 20, 2026 (updated October 23, 2026).

[2] Deeba Ahmed. “INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages.” Hackread, October 21, 2026.

[3] Cato CTRL. “Cato CTRL Threat Research: WormGPT Variants Powered by Grok and Mixtral.” Cato Networks, 2025.

[4] Anthropic. “Detecting and Countering Misuse of AI: August 2025.” Anthropic, August 2025.

[5] Anthropic. “Disrupting an AI-Orchestrated Cyber Espionage Campaign.” Anthropic, November 13, 2025.

[6] MITRE ATT&CK. “INC Ransom, GOLD IONIC, Group G1032.” MITRE Corporation, accessed October 26, 2026.

[7] Aviatrix Threat Research Center. “Phantom AI Framework: How Ransomware Affiliates Used AI Agents for Automated Intrusions (2026).” Aviatrix, October 23, 2026.

[8] CISA. “Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (AA25-163A).” Cybersecurity and Infrastructure Security Agency, June 12, 2025.

[9] Model Context Protocol. “Model Context Protocol Specification.” modelcontextprotocol.io, June 18, 2025.

[10] Cloud Security Alliance. “Using AI for Offensive Security.” CSA, 2024.

[11] Cloud Security Alliance. “Agentic AI Red Teaming Guide.” CSA, 2025.

[12] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, 2026.

[13] Cloud Security Alliance. “Ransomware in the Healthcare Industry.” CSA, 2021.