Phantom

Reported Context (2)

Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as Researchers Detail AI-Assisted Intrusions Linked to INC and The Gentlemen Affiliates
server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that SOCRadar Uncovers Exposed AI-Assisted Ransomware Infrastructure Linked to INC and The Gentlemen

CVE (3)

Malware (2)

Threat Actors (4)

MITRE ATT&CK (17)

Vendors (4)

Products (10)

Tools (9)

Industries (5)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.