AI Agents Ran INC and Gentlemen Ransomware Intrusions

Exposed infrastructure. Confirmed.

SOCRadar researchers found a command server at 45.227.254[.]43 with a publicly browsable directory logging 8,257 messages across 133 sessions. Those messages mapped to intrusion operations run by affiliates of two ransomware groups: INC and The Gentlemen. Both are assessed as Russian-speaking operators.

The setup used two AI components. First, Phantom, which the operators’ own logs describe as an “Autonomous Red Team Kill Chain Framework,” deployed via OpenCode with commercial models routed through OpenRouter. Second, WormGPT-MCP, a configuration wiring 32 Model Context Protocol servers to 32 distinct attack modules. The operational model: human operators supply victim-specific prompts and approve each step before execution. SOCRadar’s label for it is “AI-executed, human-approved.”

Where AI models refused requests, operators reframed them as authorized red team assessments. That bypass pattern is SOCRadar’s observation from log content; whether specific models accepted the reframing is not independently verified. Treat that detail accordingly.

Exploitation chain

Initial access used three CVEs against internet-facing edge services:

• CVE-2024-57727 — SimpleHelp path traversal, CVSS 7.5
• CVE-2026-35616 — FortiClient authentication bypass, CVSS 9.8
• CVE-2026-41940 — cPanel/WHM authentication bypass, CVSS 9.8

Post-access tools included Ghost C2 (three generations of polymorphic implants), RevSocks for reverse SOCKS5 pivot, and QuickLine (a Mythic agent variant). Data exfiltration targeted finance, HR, legal, and executive files before ransomware deployment.

Infrastructure communications ran over Cloudflare, Telegram, and DNS channels. A second attacker IP, 38.54.50.151, appears in the log data alongside the primary server address.

Scope

62 organizations. Over half U.S.-based. Sectors hit: industrial, manufacturing, energy, healthcare, pharmaceuticals. Four victims have confirmed data leak site listings; the remaining exposure comes from the log dataset and has not been independently verified against victim notifications.

Context

AI agent frameworks showing up in ransomware-adjacent operations have precedent here. Sysdig documented the JadePuffer campaign in July, which chained Langflow CVEs to deploy payloads through AI agent infrastructure: Sysdig: JadePuffer Uses AI Agents and Langflow CVEs to Stage Ransomware. A second JadePuffer report tracked the same cluster targeting AI model assets: JadePuffer Targets AI Assets in EncForge Follow-On Campaign.

The INC/Gentlemen infrastructure is more developed. The 32-module MCP layer represents a more integrated pipeline than what JadePuffer’s tooling showed.

CVE-2026-35616 is a FortiClient flaw. Fortinet patched it in October’s batch alongside Citrix and Ivanti: Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday. That patch and this report are related.

Source: The Hacker News, citing SOCRadar.