SOCRadar Uncovers Exposed AI-Assisted Ransomware Infrastructure Linked to INC and The Gentlemen

Oct 20, 2026 · Original article ↗

Summary

SOCRadar says seven exposed servers revealed AI-assisted operations linked to INC and The Gentlemen, including Phantom source code and 46 staged INC encryptors. Operator-reported exploitation counts are unverified; a screenshot showed encryption in progress.

Key points

An exposed command-and-control server led researchers to six more adversary-controlled servers containing AI session logs, a knowledge base, credentials, tooling and Phantom source code.
Researchers analyzed 8,257 OpenCode messages across 133 sessions. Operators used commercial models through OpenRouter, with a human approving actions; “WormGPT” was a persona prompt.
Operator records claim exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940); the reported counts were not independently verified.
The servers contained 46 INC encryptor builds prepared for six victims and an October 1, 2026 deployment. Deployment against those targets is unconfirmed, though a September 30 screenshot showed encryption running on a victim workstation.
The investigation identified records for 62 organizations, including four listed for public extortion. These records span different stages of activity, from reconnaissance to extortion.
STRU found evidence connecting the infrastructure to both ransomware brands, but assessed confidence in a formal INC–The Gentlemen alliance as low; shared operational infrastructure was considered more likely.

Article Details

Attack Vectors: Operators exploited FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel/WHM (CVE-2026-41940); the reported counts come from operator records and are not independently verified.
Stolen or reused credentials, including MSP technician credentials, enabled access to VPNs, servers, RMM tools, backup systems, and security platforms.
Operators used modified VPN connection scripts, created privileged accounts, and pushed payloads to endpoints.
The article describes malicious Word templates, HTML smuggling, and vishing plans; the only recorded campaign for the separate delivery service was an internal self-test.
After gaining access, operators enumerated domains, sought domain-admin privileges, harvested credentials, moved laterally, and collected victim files for extortion or exfiltration.
Defensive Notes: Patch FortiClient EMS, SimpleHelp, cPanel, and relevant VPN gateways; restrict internet access to management interfaces.
Review EMS for unauthorized privileged accounts and modified VPN scripts; audit RMM access and require MFA, IP allowlists, and dedicated administrator accounts.
Protect backups with immutable or air-gapped storage, isolate and patch backup consoles, and enable EDR tamper protection and vulnerable-driver blocklists.
Block remote Office template loading and HTML smuggling; monitor for unauthorized scheduled tasks, RMM agents, security-service disruption, and unusual outbound transfers.
Monitor for mass file renaming to .INC, INC-README.txt files, and the described volume and shadow-copy activity associated with encryption and recovery inhibition.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bossprotect[.]com`	Domain identified as a mail and phishing domain used in the operation.
DOMAIN	`cloud-update[.]live`	Domain identified as a MeshCentral C2 front.
DOMAIN	`driverupdate[.]app`	Domain identified as a retired C2 zone.
DOMAIN	`incblog[.]su`	Domain identified as an INC leak-site mirror.
DOMAIN	`mcgrawney[.]com`	Domain identified as a Phantom redirector zone.
DOMAIN	`stackpathcloud[.]com`	Domain identified as a retired C2 zone.
DOMAIN	`system-strategy[.]org`	Domain identified as a Ghost/Phantom redirector zone.
DOMAIN	`trulitesupport[.]com`	Look-alike customer-notice site used to pressure Trulite Glass & Aluminum Solutions.
HOSTNAME	`api[.]iquickline[.]com`	Phantom agent callback hostname.
IPV4	`138[.]124[.]113[.]210`	Ghost C2 control-panel server.
IPV4	`179[.]60[.]149[.]68`	Adversary-controlled staging and network-pivot server.
IPV4	`45[.]227[.]254[.]43`	Exposed adversary-controlled AI node containing the knowledge base, OpenCode history, Phantom source, and victim workspaces.
IPV4	`45[.]227[.]254[.]45`	Adversary-controlled build and deployment hub containing C2 builds and case data.
IPV4	`45[.]227[.]254[.]84`	Adversary-controlled operator workstation hosting a SimpleHelp console and staged INC encryptors.
IPV4	`77[.]110[.]109[.]248`	Host identified as the operators’ RevSocks reverse SOCKS5 server.
IPV4	`89[.]185[.]83[.]8`	Adversary-controlled server associated with Ghost C2 and credential-harvesting tooling.
SHA256	`0ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5`	Hash of an INC encryptor build (build B).
SHA256	`14b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212`	Hash of an INC encryptor build (build C).
SHA256	`4286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885a`	Hash of an INC Linux kit (kit 3).
SHA256	`70f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82`	Hash of an INC Linux kit (kit 1).
SHA256	`7ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20`	Hash of an INC Linux kit (kit 2).
SHA256	`ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb`	Hash of an INC Windows kit (kit 2).
SHA256	`ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463e`	Hash of an INC Windows kit (kit 1).
SHA256	`ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4`	Hash of an INC encryptor build (build A).
SHA256	`ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918`	Hash of an INC Windows kit (kit 3).