Phantom: Ransomware Affiliates Run a Human-Approved AI Kill Chain

Key Takeaways

In late September 2026, the SOCRadar Threat Research Unit (STRU) found an exposed command-and-control server. Through it, the unit recovered the tooling, AI session logs, and knowledge bases of a Russian-speaking intrusion operator. That operator works with affiliates of the INC Ransom and The Gentlemen ransomware operations [1][2]. The centerpiece is a framework called Phantom, which its authors describe as an “Autonomous Red Team Kill Chain Framework.” It ran intrusions through the open-source OpenCode agent harness, using commercial models accessed through OpenRouter [1][3].

The operating model was AI-executed and human-approved, not fully autonomous. Operators wrote a master prompt for each victim and instructed the model to “coordinate every action” with them; the model planned, generated commands, and triaged data, then waited for approval before each step [1][3]. Commercial models performed that planning and execution work. SOCRadar names anthropic/claude-opus-4.6 and moonshotai/kimi-k3 as models used through OpenRouter, and when models refused, operators reframed requests as “Authorized Red Team Assessment” templates [1][3]. Recorded AI spending on one account was about $23,900 [1][3].

The scale reflects an operational ransomware business, not a proof of concept. STRU analyzed 8,257 messages across 133 sessions and identified 62 named victim organizations, 36 of them in the United States. It also found 46 victim-specific INC encryptor builds for six victims, three of which were packaged for an October 1, 2026 deployment wave whose execution against the intended targets remains unconfirmed [1][3]. Despite the AI layer, initial access still came from unpatched edge and remote-management systems. The main vectors were FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel/WHM (CVE-2026-41940), followed by credential reuse across VPN, RMM, backup, and security consoles [1][2].

Defenders should therefore treat AI as a throughput multiplier on familiar tradecraft. The highest-value controls are edge patching, privileged-access hygiene for MSP and RMM tooling, EDR tamper protection, and immutable backups, supported by detection that keys on volume and tempo.

Background

Public reporting on AI-enabled intrusion has moved quickly over the past fourteen months. In August 2025, Anthropic disclosed a data-extortion operation it tracked as GTG-2002. In that operation, an actor used Claude Code to automate reconnaissance, harvest credentials, and penetrate networks across at least 17 organizations. Ransom demands sometimes exceeded $500,000 [4]. The same report described a criminal with limited skills who used the model to build and sell ransomware variants for $400 to $1,200 [4]. In November 2025, Anthropic reported GTG-1002, a campaign it attributed with high confidence to a Chinese state-sponsored group. It targeted roughly thirty organizations, and the AI performed an estimated 80 to 90 percent of the tactical work. Humans intervened at about four to six decision points per campaign [5]. Those disclosures came from the model provider, based on its own telemetry. They described the operator’s harness only from the outside.

The Phantom disclosure is different in kind. It comes from the attacker’s side of the screen. SOCRadar published its analysis on October 20, 2026 and updated it on October 23 [1]. The analysis rests on artifacts the operators exposed through open directories on their own infrastructure. The starting point was a C2 server at 45.227.254[.]43. Its configuration files, logs, and credentials led researchers to six more servers, most hosted on AS267784 [1]. The recovered material included source code, AI session databases, three iterations of a central knowledge base, stolen credentials, victim workspaces, and encryptor builds [1][3]. The Hacker News and GBHackers later summarized the findings [2][3]. Readers should note that nearly all public detail traces back to SOCRadar’s single analysis. As of this writing, CSA is not aware of independent confirmation from another research team, a model provider, or a government agency.

SOCRadar’s attribution assessment is measured. It expresses high confidence that the hosts were an active workbench for developing and running intrusions. It has moderate-to-high confidence in a shared operational environment between INC and The Gentlemen affiliates, and low confidence in any formal alliance between the two brands [1]. The most plausible structure is a dedicated tooling and infrastructure provider serving several ransomware partners [1][2]. This matters for defenders. If this assessment holds, Phantom-style capabilities are being offered as a service inside the affiliate economy rather than kept as one crew’s private advantage, which would broaden the set of actors able to use them.

Security Analysis

The Harness: Open-Source Agent Plumbing, Commercial Model Intelligence

Phantom’s architecture is notable for how little of it is novel AI engineering, since its core components are off-the-shelf agent and model-routing services. SOCRadar describes 18 skill modules covering reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting. A routing engine and an “autopilot” orchestrator sit alongside Python and Go agents that take tasks from a remote server [1][2]. The framework plugs into OpenCode, an open-source terminal coding agent [6]. OpenCode lets the model choose techniques and dispatch them to remote agents. Model access ran through OpenRouter, a commercial service that routes API calls to many model vendors [7]. A separate toolkit labeled “WormGPT-MCP” provided 32 Model Context Protocol servers spanning reconnaissance through extortion [1][2]. A partner guide on an adjacent server advertised “35 MCP servers,” “55+ tools,” and “9K+ CVE PoC” [1].

The “WormGPT” label deserves a correction, because it is easy to misread. According to SOCRadar, it referred to a persona prompt and MCP integrations, not to an uncensored or custom-trained model [1][3]. The intelligence behind the operation came from mainstream commercial models. The offensive capability came from the harness, the tool connectors, and the knowledge base the operators built around those models. This case, together with the GTG-1002 and GTG-2002 disclosures, suggests that criminal AI capability increasingly comes from orchestrating mainstream commercial models rather than from training bespoke ones. When an aggregator sits between operator and vendor, and malicious intent is spread across individually plausible requests, an individual model provider may have limited visibility into the full assembled capability.

Human-Approved Autonomy as a Design Choice

Despite the “autonomous” branding, the recovered sessions show a deliberate human-in-the-loop design. Each campaign began with a master prompt specific to the victim. The model was told to coordinate every action with the operator, and it waited for approval before moving to the next step [1][3]. The model planned reconnaissance, generated and debugged commands, assessed stealth options, and organized stolen data. A human authorized each step [3]. Both this operation and GTG-1002 kept a human in the loop, but the placement of that human differs: GTG-1002 involved about four to six strategic decision points per campaign [5], whereas Phantom’s operators gated every step.

CSA assesses that the approval gate likely serves the operators in three ways, although the source reporting does not state their motives directly. First, it limits the cost of model error. Anthropic noted that hallucinated credentials and overstated findings were obstacles to fully autonomous attacks in GTG-1002 [5], and a human reviewer catches these errors before they burn access. Second, it keeps a skilled operator in control of operational-security decisions on live victim networks. Third, it makes the operator the bottleneck instead of the model, which lets one person run several parallel intrusions. Defenders should not read “human-approved” as “slow.” CSA infers from the 133 sessions and 62 victims that a relatively small team could sustain high intrusion throughput by approving AI-proposed actions rather than writing them, although the source reporting does not establish the number of operators [1][3].

Safeguard Evasion Through Reframing

When commercial models refused a request, the operators did not switch to an unrestricted model. They reworded the request as an “Authorized Red Team Assessment Request” [1][2]. This is the same pretext pattern Anthropic documented in GTG-1002, where attackers told Claude it worked for a legitimate security firm doing defensive testing and split tasks into fragments that looked harmless [5]. The persistence of this technique across campaigns a year apart suggests that refusal behavior keyed on the content of each request remains brittle against operators who supply a plausible authorization context. Routing through an aggregator adds a further layer of separation, because the model vendor may see traffic attributed to the aggregator account rather than to a directly identifiable customer. Provider-side abuse detection may have to work through that indirection. Collaboration between aggregators and model vendors on abuse signals therefore becomes a material control point.

Initial Access: The Familiar Front Door

The AI layer accelerated the operation, but it did not create the openings. The operators’ records describe large-scale exploitation of internet-facing management and remote-access software, summarized in the table below. SOCRadar notes that these figures come from operator records and have not been independently verified [1].

Neither of the two leading vulnerabilities was obscure. Fortinet reported in-the-wild exploitation of CVE-2026-35616 in April 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on April 6, 2026 [8]. CISA warned in June 2025 that ransomware actors were likely exploiting CVE-2024-57727 in unpatched SimpleHelp instances to reach the downstream customers of service providers [9]. The Phantom operators followed that playbook. Compromised technician credentials expanded their access into the customers of managed service providers [3]. Within victim networks, the recurring pattern was domain enumeration, escalation to domain admin, credential harvesting, prioritization of finance, HR, legal, and executive files, and collection over reverse-SOCKS tunnels. Credential reuse was the dominant force multiplier. In one case, a single reused password opened the VPN, servers, RMM, backup, and security management platforms [2].

Impact Stage: Encryption, Extortion, and AI-Assisted Leverage

The operation reached the impact stage. STRU recovered 46 INC encryptor builds for six victims, each with its own key and victim identifier, for both Windows and Linux. Three per-victim packages were packed on September 30, 2026 for a deployment wave on October 1 [1][3]. The Windows encryptor stops backup, database, and service processes. It deletes shadow copies through direct driver calls rather than vssadmin, appends .INC, and drops INC-README.txt [1]. A SimpleHelp screenshot dated September 30 showed the encryptor running on a victim workstation, although SOCRadar states that deployment against the intended targets is unconfirmed [1]. Defense evasion relied on a Quick Heal/Seqrite security-product killer that abuses the vulnerable Zemana driver (zam64.sys) in a bring-your-own-vulnerable-driver attack. Loader-level evasion was used as well [1][2]. The operators’ own logs recorded mixed results against enterprise EDR products [1][2].

Extortion was where model assistance was most visibly applied to business judgment. AI-generated material used stolen financial data to estimate what a victim could pay without involving a bank or insurer, and to identify regulatory leverage [2][3]. A branded package for one victim set out a four-message escalation signed “The Gentlemen,” together with a vishing plan. Pressure moved from owners and executives to customers, partners, regulators, and publication, under 24- to 72-hour deadlines [1]. No cryptocurrency wallet or payment record was recovered, and final outcomes remain unknown [1][2]. The use of models for ransom calibration echoes GTG-2002, where Claude analyzed exfiltrated financials to set demand amounts [4]. Its recurrence in an unrelated operation indicates the technique has moved beyond a one-off experiment, though its overall prevalence is unknown.

Victimology

SOCRadar sorted the 62 named organizations into five mutually exclusive depth tiers (levels L1 through L5). Twelve stayed at reconnaissance only, twenty-eight reached a foothold, and fourteen reached domain-level compromise. Four reached the encryption or extortion stage, and a further four were publicly listed for extortion [1]. The leading sectors were industrial, manufacturing, and energy (16.1 percent), followed by healthcare and pharmaceutical (14.5 percent). Of the 35 targets whose revenue could be classified, 27 had revenue of $250 million or less [1]. This profile points to mid-market organizations, which CSA assesses are more likely to run exposed edge appliances and rely on outsourced IT, and less likely to have a round-the-clock detection capability.

Recommendations

Immediate Actions

Organizations running FortiClient EMS, SimpleHelp, cPanel/WHM, or SonicWall SMA1000 should confirm they have patched against the vulnerabilities above, including CVE-2026-15409, which SOCRadar reports was staged for targeting with no confirmed compromise [1]. They should remove management interfaces from the internet wherever possible. Because patching does not evict an attacker who is already inside, administrators should also hunt for signs of earlier compromise. SOCRadar recommends reviewing EMS for unexpected privileged accounts (patterns such as sysadmin, fct_svc_*, and ems_monitor_*), modified VPN connection scripts or profiles, and forged client-certificate headers [1]. Security teams should load the published indicators of compromise into blocking and hunting workflows. These include the 45.227.254[.]x and 77.110.109[.]248 infrastructure, the iquickline[.]com callback domain, the RealtekAudioSvc scheduled task, and the INC build hashes [1]. Teams should also enable EDR tamper protection and add vulnerable drivers, including zam64.sys, to driver blocklists.

Short-Term Mitigations

Over the coming weeks, the priority is to close the credential-reuse paths that turned single footholds into full compromises. That means dedicated, MFA-protected administrative accounts for VPN, RMM, backup, hypervisor, and security consoles. It also means IP allowlisting for management planes, LAPS and group managed service accounts, and enforcement of administrative tiering [1]. Organizations that rely on managed service providers should require the same controls of their providers by contract, since compromised technician credentials were a documented pivot into MSP customers [3]. Backups should be immutable or air-gapped, and hypervisors, ESXi hosts, and central file servers should be segmented from general user networks [1]. Detection engineering should cover the behaviors SOCRadar highlights. These include Office applications spawning PowerShell, curl, or certutil; non-domain-controller replication requests and shadow-copied ntds.dit reads; spikes in RC4 Kerberos service tickets; restic or rclone transfers to external object storage; and Restart Manager sessions from non-installer processes [1].

Strategic Considerations

The broader lesson concerns tempo and scale. An AI-executed, human-approved operating model lets a small team run reconnaissance, exploit development, triage, and extortion drafting in parallel across dozens of victims. Defenses that depended on attackers being slow or scarce lose value as a result. As a planning assumption, security leaders should expect that the time from exposure to exploitation will keep shrinking. They should invest in automated exposure management and response playbooks that work faster than analysts can triage manually.

Organizations that build or deploy agentic AI face a second set of considerations. The Phantom stack — an open-source agent harness, MCP tool servers, a persistent knowledge base, and model access through an aggregator — has the same structure as legitimate enterprise agent deployments. Controls that govern those deployments therefore also form part of the defensive story. These include logging of agent sessions, authorization of tool calls, and identity attribution through intermediaries. Model providers and aggregators should consider sharing abuse signals across the routing layer. They should also treat “authorized red team” framing without verifiable context as a risk signal rather than a trust signal. Enterprises that sell or host penetration-testing agents should assume that their own products and skill modules are templates that adversaries will copy.

Finally, the evidence base calls for caution. The Phantom findings rest largely on one vendor’s analysis of leaked operator records, and several of the reported exploitation counts are the operators’ own claims [1]. Defenders should act on the patching, credential-hygiene, and detection guidance, which is sound regardless of attribution. Strategic conclusions about the maturity of AI-run ransomware operations should be revisited as independent corroboration emerges.

CSA Resource Alignment

Phantom is consistent with the trajectory described in CSA’s recent threat research. Autonomous Agentic AI Adversaries (June 2026) argued that frontier models had crossed from tool to actor in offensive operations. It drew on GTG-1002 and related cases, and it introduced a distinction between AI-assisted and AI-autonomous attack along with an “autonomy threshold” [10]. Phantom sits in an informative position on that spectrum. Its architecture can run autonomously, but its operators chose to gate every step behind human approval. This is consistent with that paper’s argument that the practical threat is attack-lifecycle compression and throughput, not the absence of humans. Its recommendations on structural defense posture and agent identity apply directly here.

CSA’s research note LLM Agents as Offensive Post-Exploitation Tools examined how agent harnesses with tool access convert model reasoning into hands-on-keyboard activity inside compromised environments [11]. Phantom’s pairing of OpenCode with remote Python and Go agents and MCP tool servers is a fielded instance of that pattern. Defenders can use that note’s post-exploitation detection guidance alongside the SOCRadar hunting queries.

For threat modeling, CSA’s MAESTRO framework gives a layered way to analyze where controls could have interrupted the Phantom stack [12]. Relevant layers include the foundation model accessed through an aggregator, the agent framework, the tool and MCP ecosystem, and the persistent knowledge base used as agent memory. For control implementation, the AI Controls Matrix (AICM) v1.1 provides the mapping [13]. Its Identity and Access Management and Threat and Vulnerability Management domains address the edge patching and credential-reuse failures that enabled initial access and lateral movement. Its logging, monitoring, and model-governance controls are relevant to providers and aggregators seeking to detect misuse through pretexts such as “authorized red team” requests.

References

[1] SOCRadar Threat Research Unit. “INC and The Gentlemen Ransomware: Exposed AI Infrastructure.” SOCRadar, October 20, 2026 (updated October 23, 2026).

[2] Lakshmanan, Ravie. “Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions.” The Hacker News, October 23, 2026.

[3] Kathir, Mayura. “INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds.” GBHackers, October 21, 2026.

[4] Anthropic. “Detecting and Countering Misuse of AI: August 2025.” Anthropic, August 27, 2025.

[5] Anthropic. “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign.” Anthropic, November 13, 2025.

[6] OpenCode. “OpenCode: The AI Coding Agent Built for the Terminal.” OpenCode, accessed October 24, 2026.

[7] OpenRouter. “OpenRouter Documentation.” OpenRouter, accessed October 24, 2026.

[8] Censys. “April 7 Advisory: Improper Access Control Vulnerability in Fortinet FortiClient EMS (CVE-2026-35616).” Censys, April 2026.

[9] CISA. “Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (AA25-163A).” Cybersecurity and Infrastructure Security Agency, June 12, 2025.

[10] Cloud Security Alliance AI Safety Initiative. “Autonomous Agentic AI Adversaries.” Cloud Security Alliance, June 24, 2026.

[11] Cloud Security Alliance AI Safety Initiative. “LLM Agents as Offensive Post-Exploitation Tools.” Cloud Security Alliance, June 1, 2026.

[12] Huang, Ken. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 6, 2025.

[13] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, 2025.