AI Agents on the Job: Ransomware Crews Automate Break-Ins With the Phantom Framework

Researchers at SOCRadar have documented an entire intrusion infrastructure built around artificial intelligence and serving affiliates of the INC and The Gentlemen ransomware groups. At its heart is a framework called Phantom — an "autonomous red team kill chain." The actor behind it, assessed to be Russian-speaking, acts both as an intrusion-and-extortion operator and as an infrastructure provider for other players in the ecosystem.

Human sets the task, the model carries it out

The campaign's defining trait is its "AI-executed, human-approved" structure. The operator supplies a victim-specific prompt and reviews every step, while the intrusions themselves run through the OpenCode tool using commercial models hosted on OpenRouter. On an exposed directory at 45.227.254[.]43, researchers found the logs: 8,257 messages across 133 sessions. When a model refused a request, the operator did not simply switch to another one — he rewrote the task as an "authorized red team assessment" and bypassed the guardrails that way.

How the intrusions worked

Initial access came from exploiting public-facing edge devices at scale — FortiClient EMS, SimpleHelp, cPanel, VPN gateways. The operators' records list a range of flaws, including the actively exploited CVE-2024-57727 (SimpleHelp), CVE-2026-35616 (FortiClient) and CVE-2026-41940 (cPanel/WHM). What followed was a recurring lifecycle: enumerate the domain, escalate to domain admin where possible, harvest credentials, prioritize finance, HR, legal and executive files, and collect them over reverse-SOCKS tunnels.

Credential reuse proved the main force multiplier: in one case a single reused password unlocked the VPN, servers, remote management, backup and security platforms at once. Defenses were suppressed with a BYOVD attack abusing the Zemana driver, though the attackers' own logs note mixed results against enterprise EDRs.

The toolkit includes Phantom with 18 skill modules, the WormGPT-MCP set of 32 Model Context Protocol servers, the polymorphic Ghost C2 implants, the RevSocks reverse proxy and several other utilities.

Pressure calculated by algorithm

Dozens of AI-authored extortion records reveal a data-centric approach: the stolen financials were examined to gauge how much a victim could pay without involving a bank or insurer. Then came masked proof samples, scripted vishing calls, and threats to notify customers, partners and regulators. If payment did not arrive within 24–72 hours, the data was published on a leak site.

In all, an estimated 62 organizations were targeted, four of which ended up listed on the INC and The Gentlemen leak sites. More than half of the targets were in the U.S.; industrial, manufacturing and energy firms were hit most, followed by healthcare and pharmaceuticals. The real outcomes of the ransom demands remain unknown — no crypto wallets or payment records were recovered.

Source: The Hacker News