Phantom: Ransomware Affiliates Ran AI Agents Through the Kill Chain

A misconfigured server did what no vendor report usually can: it let defenders read an active ransomware crew's AI tooling from the inside. Researchers at SOCRadar's Threat Research Unit pulled the knowledge base, the session logs, and the source code of a framework the operators call Phantom — an "Autonomous Red Team Kill Chain Framework" that affiliates working with INC Ransomware and The Gentlemen used to plan and run intrusions. This is the first time the public gets to see not the marketing claim about "AI-powered attacks," but the actual message logs: 8,257 of them, across 133 sessions, with a running API bill.

Developing story — first published 23:36 CEST (21:36 UTC), October 23, 2026. Updated as SOCRadar and the affected vendors publish more.

What SOCRadar found behind the Phantom framework

The entry point was an exposed command-and-control host at 45.227.254[.]43. It held the operators' central knowledge base, their AI session databases, and the Phantom source itself. Credentials and configuration files on that box led to six more adversary servers — seven in total, most sitting on AS267784 (Flyservers S.A.), with ghost C2 activity going back to mid-July 2026. SOCRadar assesses "with high confidence that the hosts served as an active intrusion-development and operational workbench," per its Threat Research Unit report.

Phantom itself is not a chatbot wrapper. The report describes 18 skill modules, a routing engine, an autopilot orchestrator, and the crew's own agents written in Python and Go. Those agents masquerade as Windows Update components and call back to api.iquickline[.]com. A fleet of 32 "WormGPT-MCP" servers wires the model into the actual tooling, so the AI can reach from reconnaissance through to extortion without the operator leaving the chat window.

The operators are assessed as Russian-speaking, most active between 06:00 and 14:00 UTC. SOCRadar puts low confidence on a formal dual-brand alliance between INC (tracked by MITRE as G1032) and The Gentlemen, but moderate-to-high confidence that both were operating out of the same shared environment.

The AI stack was deliberately boring

The most useful finding is the least dramatic one. There was no bespoke evil model. "WormGPT" was a persona prompt, not a product. The operators drove everything through OpenCode as the interface, calling standard commercial models over OpenRouter — the logs name anthropic/claude-opus-4.6 and moonshotai/kimi-k3. When a model refused a request, the operators did not switch to some uncensored alternative; they reworded the task as an authorized red team assessment and the refusal went away.

Two details from the logs are worth sitting with:

• Each step required operator approval. Every campaign opened with a victim-specific master prompt, and the AI was instructed to coordinate every action with a human. This was not fire-and-forget autonomy. It was an operator with an AI force multiplier, approving moves.
• The AI did the planning work, not the magic. Per SOCRadar, the model planned reconnaissance, selected techniques, generated commands, triaged stolen data, and drafted the extortion reports. The recorded spend topped $23,920 in API fees across those 8,257 messages.

"We blocked the dangerous model" is the wrong mental model. There was no dangerous model. There was a cheap, compliant, general-purpose one, pointed at your perimeter by someone who knew to call it a pentest.

That reframes the defender's problem. You are not up against a jailbroken superweapon. You are up against commodity intelligence applied with patience to the same edge appliances you already know are exposed.

The kill chain ran on edge appliances you can patch

Phantom's agents did not invent novel zero-days. They industrialized the exploitation of known, already-cataloged edge vulnerabilities — the same remote-access and hosting products that show up in every quarter's incident data. The operators' own logs, as read by SOCRadar, record the work in volume:

Product	Vulnerability	Operator-logged activity
FortiClient EMS	CVE-2026-35616 (CVSS 9.8, KEV)	2,236 targets; 108 backdoor admin accounts created; 4,140 managed endpoints reached
SimpleHelp	CVE-2024-57727 (path traversal, KEV)	4,922 servers scanned; 427 admin passwords obtained; 242 unique IPs impacted
cPanel / WHM	CVE-2026-41940 (auth bypass, CVSS 9.8, KEV)	49+ claimed breaches of small hosting providers
VPN gateways	Ivanti, Citrix, SonicWall, OpenVPN evaluated	3 recorded compromises; ZeroLogon, PrintNightmare, noPac attempted

Every one of those three named CVEs is in CISA's Known Exploited Vulnerabilities catalog with a fix available. The AI's contribution was not discovery. It was scale and patience: scan thousands of hosts, triage what responds, write the next command, repeat, and hand the operator a shortlist of live footholds. By September 30, 2026 the crew had packed 46 INC encryptor builds for six victims and staged them for an October 1 deployment; a SimpleHelp screenshot from that day shows the encryptor already running on a victim workstation. The Gentlemen side was preparing an extortion package against Leo Schachter Diamonds. SOCRadar counts 62 named target organizations, 36 of them in the United States, led by industrial, manufacturing, and energy at 16.1%.

This is the same brand whose affiliate economics Security Affairs documented in June: external affiliates keep 90% of each ransom, access is bought from commodity infostealers, and the core team maintains the panel. Phantom is what you get when that affiliate model bolts an AI planner onto the front.

Close these doors now

The framework is the headline; the exposure it rode is the thing you can act on today.

• Inventory the four product families above. If you run FortiClient EMS, SimpleHelp, cPanel/WHM, or an internet-facing VPN gateway, treat them as the first-class targets they are. Confirm you are past the fixed versions for each KEV-listed CVE — these are not optional patches, they are actively exploited.
• Hunt for the known indicators. Look for outbound connections to api.iquickline[.]com, processes masquerading as Windows Update that have no legitimate update lineage, and newly created admin accounts on FortiClient EMS and SimpleHelp that no one on your team recognizes. The 108 backdoor admins and 427 harvested SimpleHelp passwords in the logs are the pattern, not a one-off.
• Rotate what the edge box could reach. An auth bypass or path-traversal on a management appliance means every credential stored on or reachable from it is suspect. Patching a compromised host does not un-leak its secrets.
• Assume the operator was patient. Ghost C2 ran from mid-July. Access bought from infostealers can sit unused for months. Check session-token reuse and dormant admin accounts, not just last week's logs.

For the broader question this raises — how do you find these footholds before an attacker's agent does — the honest answer is to run the same kind of testing against yourself, continuously, not once a year. Our guide to automated penetration testing walks through what that cadence looks like. This is also not the first time we have watched an attacker point an autonomous agent at live targets: see Cairn's agents breaching 100+ companies for ~$5,000 and AI agents harvesting thousands of credentials in under six hours.

What is not known yet

• The true victim total. SOCRadar names 62 organizations and reports 427 SimpleHelp admin passwords and 108 FortiClient backdoor admins, but gives no single credential or confirmed-breach count. The operator-logged target numbers are claims from the crew's own dashboards, not independently verified compromises.
• Whether INC and The Gentlemen are formally allied. The evidence supports a shared workbench, not a merged program. Attribution confidence is explicitly low on a dual-brand alliance.
• How the AI providers will respond. A live check on October 5, 2026 found two active, paid OpenRouter accounts still in use. Whether those get shut down — and whether the operators simply re-provision — is open.
• What else Phantom can do. 18 skill modules and an autopilot were recovered from one exposed host. The modules not yet detailed in the public report are the unknown.

Where this leaves defenders

The uncomfortable takeaway is that the attacker's architecture and the defender's should now look similar. Phantom is an autonomous red team with a human approving each move against a list of edge appliances. The only durable answer to an adversary running that is to run a governed version of it against your own perimeter first — and to get there before the attacker's agent does.

That is the shape of Zero Hunt. It is an autonomous AI red team that runs on-premise on its own private models, with a human in the loop for every action that matters — the same approval discipline the Phantom logs showed, except the findings are yours. A 10-agent swarm fingerprints the exact version of each exposed FortiClient EMS, SimpleHelp, or cPanel instance and writes a generative, per-target exploit chain — not a catalog lookup — backtested in the AI Gym before it ever touches production, with every finding signed at write time (Ed25519, hash-chained) for the audit trail. Because the models are local, there is no OpenRouter bill to drain, no third party that can refuse, throttle, or switch the capability off, and no customer data leaving the appliance. It answers the attacker's question from the attacker's vantage: can an agent reach a live foothold on my edge before I notice?

And because Phantom's whole value was patience on the wire — thousands of scans, slow staging, encryptor builds packed days ahead — the complementary surface is the network itself. Zero Hunt's traffic analysis runs a deep-learning model with four parallel inference heads on the appliance GPU, trained on billions of PCAP sequences, watching for the anomalous scanning, the never-seen callback, and the staging burst while they happen — not in the next morning's SIEM digest, which for the September 30 victim would have arrived the day the files were already being encrypted.