Researchers Detail AI-Assisted Intrusions Linked to INC and The Gentlemen Affiliates
Summary
SOCRadar describes exposed infrastructure used in AI-assisted intrusions attributed to a Russian-speaking operator linked to INC and The Gentlemen ransomware affiliates. Records show 62 organizations were targeted; four were listed on the groups’ leak sites.
Key points
- SOCRadar attributed the operation to a Russian-speaking intrusion and data-extortion operator assessed to support partners in the INC and The Gentlemen ransomware ecosystems.
- An exposed directory contained 8,257 messages across 133 sessions. The operators used the Phantom framework and an AI-assisted workflow in which humans prompted and reviewed activity.
- Reported initial access involved exploiting exposed edge and remote-access systems, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways.
- Operator records described domain enumeration, privilege escalation, credential harvesting and reuse, persistence, and collecting files over reverse-SOCKS tunnels.
- Reported tools and techniques included the QuickLine Mythic agent, Ghost C2 variants, RevSocks, and a BYOVD EDR killer using the Zemana driver; the operators recorded mixed results against enterprise EDR.
- Extortion records reportedly show operators assessing victims’ financial data, sending masked proof samples, and using scripted vishing and threats to notify stakeholders. Final payment outcomes are unknown; no cryptocurrency wallet or payment record was recovered.
- SOCRadar estimated 62 organizations were targeted, with four listed on INC or The Gentlemen leak sites. More than half of targets were in the U.S.; industrial, manufacturing, and energy organizations were prominent.
Article Details
- Attack Vectors
- Exploitation of internet-facing edge and remote-access systems, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways.
- Reuse of stolen credentials to access VPNs, servers, remote-management systems, backup systems, and security-management platforms.
- Lateral movement, domain enumeration, credential harvesting, and collection of finance, HR, legal, and executive files.
- Data collection and exfiltration over reverse-SOCKS tunnels.
- Impairment of security products using a BYOVD killer and loader-level evasion.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]227[.]254[.]43 | IP address hosting an exposed operator directory that recorded activity attributed to the intrusion operation. |
MITRE ATT&CK
T1078 · Valid AccountsCredential reuse enabled access to VPNs, servers, remote-management systems, backup systems, and security-management platforms.T1090 · ProxyThe operators used RevSocks reverse-SOCKS proxies for network pivoting and collected data over reverse-SOCKS tunnels.T1190 · Exploit Public-Facing ApplicationThe operators exploited public-facing edge and remote-access systems, including FortiClient EMS and SimpleHelp servers.T1562.001 · Disable or Modify ToolsA BYOVD killer and loader-level evasion were used to impair security products.
Threat Actors
Products
cPanel"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways," SOCRadar said. "They used AI-managed knowledge bases to track victims, stolenFortiClient EMS"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways," SOCRadar said. "They used AI-managed knowledge bases to track victims, stolenOpenVPNof exposed internet services, specifically targeting FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls," SOCRadar said.Quick Heal/Seqrite EDROther tools include a Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 andSimpleHelp"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways," SOCRadar said. "They used AI-managed knowledge bases to track victims, stolen
Tools
BackupAgentthe Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.Ghost C2via the Phantom framework, established RevSocks reverse-SOCKS proxies for network pivoting, deployed Ghost C2 variants, and utilized AI-managed knowledge bases to meticulously log victim telemetry, compromisedMythicOther tools include a Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 andopencodea victim-specific prompt and reviews every step, while the intrusions themselves are executed through OpenCode with OpenRouter-hosted commercial models.PhantomCentral to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, asQuickLineOther tools include a Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 andrevsocks"Concurrently, they orchestrated operations via the Phantom framework, established RevSocks reverse-SOCKS proxies for network pivoting, deployed Ghost C2 variants, and utilized AI-managed knowledge bases to meticulouslyrks3that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.zam64.sysMythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.
Countries
Industries
Energyfor more than 50% of the targets. The attacks also primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.Healthcaretargets. The attacks also primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.Industrialransomware. The U.S. accounts for more than 50% of the targets. The attacks also primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.ManufacturingThe U.S. accounts for more than 50% of the targets. The attacks also primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.pharmaceuticalalso primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.