// AI threat desk · 24 Oct 2026
Home/AGENT · Agent Security
Agent SecurityHighAICVSS not assigned

SOCRadar uncovers AI-driven intrusion ecosystem tied to ransomware affiliates

SOCRadar said INC and The Gentlemen affiliates ran AI-assisted intrusions and actively exploited FortiClient EMS, SimpleHelp and cPanel. SOCRadar published the findings on Oct 20, 2026.

· 3 min read
AI-generated image of security analysts monitoring blurred cyberattack dashboards in a dark operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • SOCRadar uncovered an AI-driven intrusion ecosystem run by affiliates of INC and The Gentlemen.
  • Operators logged 8,257 messages across 133 sessions while using OpenCode with commercial models hosted on OpenRouter.
  • Records showed active exploitation of FortiClient EMS, SimpleHelp and cPanel or WHM vulnerabilities.

SOCRadar said it uncovered an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups, according to findings published on Oct 20, 2026.

The operators' records showed active exploitation of vulnerabilities in FortiClient EMS, SimpleHelp and cPanel or WHM, while a September 30 screenshot showed an encryptor running on a victim workstation. SOCRadar said deployment against these targets is unconfirmed.

SOCRadar said the operation combined a human operator who directs and approves with an AI stack, and that operators logged 8,257 messages across 133 sessions.

On this page

OpenCode stack planned reconnaissance and generated commands

SOCRadar said the human operator directs and approves, while OpenCode, OpenRouter-hosted models, the Phantom skill library and a persistent knowledge base plan reconnaissance, select techniques, generate commands, triage stolen data and draft reports.

SOCRadar described Phantom as a modular ‘Autonomous Red Team Kill Chain Framework’ with 18 skill modules, an autopilot and its own agents.

SOCRadar said a live check on Oct 5, 2026 found two active, paid OpenRouter accounts, one of them nearly exhausted after $23,920 in spending.

FortiClient EMS activity reached 4,140 managed endpoints

The FortiClient EMS records contained 2,236 reported targets, 108 created administrator accounts and 4,140 managed endpoints. SOCRadar also said scans of 4,922 SimpleHelp servers yielded 427 administrator passwords across 242 unique IP addresses.

The operators claimed more than 49 cPanel breaches involving small hosting providers. Across the exposed infrastructure, SOCRadar said they also targeted Ivanti, Citrix, SonicWall and OpenVPN gateways, as well as SimpleHelp remote-management servers and cPanel hosting controls.

Industrial and energy organizations made up 16.1% of classifiable targets

Industrial, manufacturing and energy organizations accounted for 16.1% of classifiable targets, followed by healthcare and pharma at 14.5%.

The Hacker News said the operation was estimated to have targeted 62 organizations, with four listed on INC or The Gentlemen data-leak sites. It said more than half of the estimated targets were in the United States.

The Hacker News said the recurring intrusion lifecycle included lateral movement, persistence, data exfiltration and escalation toward ransomware deployment. It also said data was published on a data-leak site when victims failed to pay within a 24- to 72-hour deadline, although final ransom outcomes were unknown.

SOCRadar said defenders should patch FortiClient EMS, Fortinet and SonicWall gateways, remove internet access to management interfaces and review EMS for unauthorized administrators or modified VPN connection scripts.

The researchers rated confidence in a formal alliance between INC and The Gentlemen as low, while rating confidence in a shared operational environment used by operators across both groups as moderate to high.

What to do now

  1. Patch FortiClient EMS, Fortinet and SonicWall gateways, remove internet access to management interfaces, and review EMS for unauthorized admins or modified VPN connection scripts.

FAQ

What did SOCRadar uncover?

SOCRadar uncovered an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

Which systems did the operators exploit?

Operator records showed active exploitation of FortiClient EMS, SimpleHelp and cPanel or WHM vulnerabilities. SOCRadar also identified targeting of Ivanti, Citrix, SonicWall and OpenVPN gateways.

How many systems were targeted through FortiClient EMS?

The operators reportedly targeted 2,236 FortiClient EMS systems, created 108 administrator accounts and reached 4,140 managed endpoints.

Was ransomware deployment confirmed?

Deployment against the staged targets was unconfirmed, although a September 30 screenshot showed an INC encryptor running on a victim workstation.

How did the AI-assisted operation work?

The human operator directs and approves, while the AI stack plans reconnaissance, selects techniques, generates commands, triages stolen data and drafts reports through OpenCode, OpenRouter-hosted models, Phantom and a persistent knowledge base.

Sources

  1. INC and The Gentlemen Ransomware: Exposed AI Infrastructure, SOCRadarPrimary
  2. Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions, The Hacker News
  3. Chilling: Warlock Ransomware Reveals How Old Bugs Still Cripple Critical Infrastructure, The Tech Edvocate
How we checked this story
ClaimSourceStatus
SOCRadar uncovered an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.SOCRadarConfirmed
The operators ran intrusions through OpenCode with commercial models hosted on OpenRouter and logged 8,257 messages across 133 sessions.SOCRadarConfirmed
Operator records showed active exploitation of FortiClient EMS, SimpleHelp and cPanel or WHM vulnerabilities.SOCRadarConfirmed
The operators reportedly targeted 2,236 FortiClient EMS systems, created 108 administrator accounts and reached 4,140 managed endpoints.SOCRadarConfirmed
SOCRadar reported that scans of 4,922 SimpleHelp servers yielded 427 administrator passwords and affected 242 unique IP addresses.SOCRadarConfirmed
The operators reportedly claimed more than 49 cPanel breaches of small hosting providers.SOCRadarConfirmed
A September 30 screenshot showed an INC encryptor running on a victim workstation, although deployment against the staged targets was unconfirmed.SOCRadarConfirmed
Industrial, manufacturing and energy organizations accounted for 16.1% of classifiable targets, followed by healthcare and pharma at 14.5%.SOCRadarConfirmed
SOCRadar assessed confidence in a formal INC and The Gentlemen alliance as low, while rating shared operational-environment confidence moderate to high.SOCRadarConfirmed
Defenders should harden managed-service-provider and remote-management environments with multifactor authentication, IP allowlists and dedicated administrator accounts.SOCRadarConfirmed
The Hacker News reported that the threat actor was assessed to be Russian-speaking and operated as an intrusion and data-extortion operator and infrastructure provider.The Hacker NewsAttributed
The Hacker News said the campaign used an AI-executed, human-approved structure in which an operator supplied a victim-specific prompt and reviewed every step.The Hacker NewsAttributed
The Hacker News said the operators’ recurring intrusion lifecycle included lateral movement, persistence, data exfiltration and escalation toward ransomware deployment.The Hacker NewsAttributed
The Hacker News said phantom was deployed through OpenCode and used an agent that retrieved tasks, executed commands and returned outputs from an external server.The Hacker NewsAttributed
The Hacker News said wormGPT-MCP comprised 32 MCP servers connecting the AI system to modules ranging from reconnaissance to extortion.The Hacker NewsAttributed
The Hacker News said the operators examined stolen financial data to estimate payment capacity and used masked samples, vishing and threats to notify customers, partners and regulators.The Hacker NewsAttributed
The Hacker News said the stolen data was published on a data-leak site when victims failed to pay within a 24- to 72-hour deadline, although final ransom outcomes were unknown.The Hacker NewsAttributed
The Hacker News said the operation was estimated to have targeted 62 organizations, four of which were listed on INC or The Gentlemen data-leak sites.The Hacker NewsAttributed
The Hacker News said more than half of the estimated targets were in the United States, with industrial, manufacturing and energy organizations primarily targeted.The Hacker NewsAttributed
SOCRadar said the operators targeted FortiClient EMS, Ivanti, Citrix, SonicWall, OpenVPN and SimpleHelp systems, along with cPanel hosting controls.SOCRadar, via The Hacker NewsAttributed
The Tech Edvocate said Warlock breached at least four organizations in water utilities, telecommunications, regional government and higher education during the two months before October 1, 2026.The Tech EdvocateAttributed
The Tech Edvocate said Warlock used the Microsoft SharePoint ToolShell vulnerability chain, which was first exploited in July 2025.The Tech EdvocateAttributed
The Tech Edvocate reported 2,627 ransomware attacks globally in the third quarter of 2026.The Tech EdvocateAttributed
The Tech Edvocate recommended regular automated vulnerability scans, penetration tests, network segmentation and tested incident-response and disaster-recovery plans.The Tech EdvocateAttributed
socradar.io published its report on Oct 20, 2026.socradar.ioConfirmed

Could not verify

  • Whether all 62 named organizations experienced successful compromise is not established.
  • Whether the staged October 1 encryptor deployment reached the six intended victims is not established.
  • Whether INC and The Gentlemen operated under a formal alliance is not established.
  • Whether any ransomware payments were made is not established.
ransomware
See all in Agent Security →
Explore with AI
ChatGPT
Claude
Perplexity
Grok