Yaamlabs
Ransomware

Ransomware affiliates ran intrusions through an AI agent

Exposed servers show INC and Gentlemen affiliates driving edge exploits through an AI framework, one approval at a time. The tradecraft and what to hunt for.

By Yaali. October 25, 2026, 6 min read, Ransomware, Threat intel, AI security.

Cover illustration of an open server rack spilling glowing document cards next to a robotic arm over an approval button, with the Yaamlabs logo and the text: Ransomware affiliates let AI agents run intrusions, 8,257 AI messages left on exposed servers

On October 20, SOCRadar's threat research unit published what it found on seven exposed servers run by affiliates of the INC and The Gentlemen ransomware groups. One command-and-control server was left open to the internet with its AI session databases, the operators' knowledge base and the source code of an attack framework called Phantom. Credentials and logs on that box led to six more. Together they show, prompt by prompt, how a ransomware crew used commercial AI models to plan and run intrusions, with a person approving every step.

This matters if you run FortiClient EMS, SimpleHelp, cPanel and WHM, or a VPN gateway on the internet, or if an MSP reaches your network through remote-support tools. The three flaws behind most of the access were known and already patched. The AI made the affiliates faster and broader, and the records show what to hunt for.

The affiliates' operating loop: an operator writes a victim-specific brief, the AI agent proposes the next action, the operator approves it, tools run it against edge systems, and results feed the knowledge base, with figures of 8,257 messages, 133 sessions, $23,920 in AI spend and 46 encryptor builds

How the operation was built

The operators worked in OpenCode, an open-source AI coding agent that runs in a terminal, connected to commercial models through OpenRouter, a service that resells access to many model providers under one account. SOCRadar and Hackread both name Anthropic's Claude Opus 4.6 and Moonshot AI's Kimi K3 among the models used. The logs hold 8,257 messages across 133 sessions, and SOCRadar counts $23,920 in AI spending (its own write-up also says "more than $23,000" in one place).

Each campaign started with a master prompt written for that victim, telling the agent to "coordinate every action with me". The model proposed commands, wrote scripts, sorted stolen credentials and drafted reports; the human approved each action before it ran. "WormGPT" in the tooling was only a persona prompt on top of mainstream models. When a model refused, the operators reworded the request as an "Authorized Red Team Assessment Request" rather than switching models.

Around the agent sat custom tooling. Phantom, described in its own code as an "Autonomous Red Team Kill Chain Framework", has 18 skill modules and agents that pose as Windows Update components. A set of 32 Model Context Protocol (MCP) servers, the plug-in interface that lets an AI agent call outside tools, included one for ransom negotiation and pricing. Implants included a polymorphic family SOCRadar calls Ghost C2, plus Sliver, Ligolo-ng, Chisel and RevSocks for tunnels.

What the affiliates did

The way in was internet-facing management software. The counts below come from the operators' own records, which SOCRadar did not verify victim by victim:

  • FortiClient EMS, CVE-2026-35616. A pre-authentication API access bypass in EMS 7.4.5 and 7.4.6, exploited since early April. Fortinet's advisory is FG-IR-26-099; scores differ (9.1 in most reports, 9.8 on NVD). The records claim 2,236 targets, 108 admin accounts created and 4,140 managed endpoints in reach. The affiliates planted backdoor EMS admins and pushed payloads to endpoints through modified VPN connection scripts.
  • SimpleHelp, CVE-2024-57727. An unauthenticated path traversal (CVSS 7.5) that lets anyone download server files, including technician credentials. The records show 4,922 servers scanned and 427 admin passwords taken. Stolen MSP technician logins opened the MSPs' clients too.
  • cPanel and WHM, CVE-2026-41940. A CRLF injection into the pre-login session file (CVSS 9.8) that lets an attacker write user=root into their own session. The affiliates claim more than 49 small hosting providers breached, used to reach hosted mail.

Inside, the pattern was conventional: domain enumeration with BloodHound and NetExec, Kerberoasting, NTDS.dit copied from shadow copies, DCSync, and Zerologon against two domain controllers. Credential reuse did most of the work; in one case a single password opened the VPN, servers, the remote management tool, backups and security platforms. To blind defenders they loaded the vulnerable Zemana anti-malware driver to kill Quick Heal and Seqrite products, a bring-your-own-vulnerable-driver (BYOVD) attack, with mixed results against enterprise EDR. Data left over reverse SOCKS tunnels and restic or rclone.

The records list 46 INC encryptor builds for six victims, Windows and Linux. Three packages were packed on September 30 for an October 1 deployment, and a SimpleHelp screenshot from September 30 shows an encryptor running on a victim workstation. The Windows build deletes shadow copies with direct driver calls instead of vssadmin, appends .INC and drops INC-README.txt. The records name 62 organisations, 36 in the US, led by manufacturing and energy (16.1%) and healthcare and pharma (14.5%).

Where to catch the affiliates at each of six stages, from edge access and footholds to credential theft, defence impairment, exfiltration and encryption, with one signal per stage and the patched versions of the three entry points

What to do

  1. Patch the entry points. FortiClient EMS to 7.4.7, or apply Fortinet's hotfix on 7.4.5 and 7.4.6 (7.2 is not affected). SimpleHelp to 5.5.8, 5.4.10 or 5.3.9 or later. cPanel and WHM to the fixed build for your branch, such as 11.134.0.20 or 11.136.0.5 (WP Squared 136.1.7), then restart cpsrvd. Check Zerologon is enforced and retire any Windows Server 2008 R2 domain controllers.
  2. If you cannot patch today, take the management interfaces off the internet. Put EMS and the SimpleHelp console behind a VPN or an IP allowlist, and block TCP 2083 and 2087 to cPanel and WHM from outside. Make MSPs who reach you through SimpleHelp or similar tools use MFA and a fixed source IP.
  3. Check EMS and SimpleHelp first. In EMS, look for admin accounts named sysadmin, fct_svc_* or ems_monitor_*, VPN profiles or connection scripts you did not change, and gaps in the audit log. In SimpleHelp, review the technician list and recent logins, and assume any technician password on an unpatched server is known.
  4. Hunt across the network. Directory replication requests from hosts that are not domain controllers (Event ID 4662 with the replication GUIDs). Reads of ntds.dit from a shadow copy path. A jump in RC4 Kerberos service tickets (Event ID 4769, encryption type 0x17). A scheduled task named RealtekAudioSvc. Office processes starting PowerShell, curl or certutil, or loading a remote .dotm template.
  5. Watch the last stages. The Zemana driver loading followed by security services stopping. restic or rclone running on servers, with bulk uploads to object storage. Mass renames to .INC, and volume handles opened with IOCTL 0x53C028, the volume shadow copy resize call that silently deletes snapshots without touching vssadmin.
  6. Block the published indicators. SOCRadar lists C2 and staging IPs 45.227.254[.]43, 45.227.254[.]45, 45.227.254[.]84, 179.60.149[.]68, 77.110.109[.]248 and 89.185.83[.]8, and domains including iquickline[.]com, driverupdate[.]app, cloud-update[.]live and stackpathcloud[.]com. Its loader hides at /assets/js/analytics.js.
  7. If you find any of this, rotate every credential the attacker could have seen, starting with the reused ones: VPN, RMM, backup and security console admins, the KRBTGT account (twice) and service accounts. Turn on EDR tamper protection and Microsoft's vulnerable driver blocklist, and keep one backup copy immutable or offline.

What the AI added

The exploits that produced access were all public: the affiliates used a SimpleHelp bug disclosed in January 2025 and two flaws patched in April 2026, all on CISA's Known Exploited Vulnerabilities list. The agent added throughput: one operator could scan thousands of servers, triage hundreds of stolen passwords and keep several victims moving at once, for $23,920 in model fees across the whole operation. The approval gate also means activity arrives at human pace, so detections built on timing or volume alone may miss it. Behaviour detections, such as a new EMS admin, DCSync from a workstation or a driver load just before EDR stops, work whoever is typing.

Our attack surface management work finds management consoles like EMS, SimpleHelp and WHM that should not face the internet, and our security operations team hunts for the post-exploitation signals listed here. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: SOCRadar, Hackread, Let's Data Science, Cloud Security Alliance on CVE-2026-35616, Qualys on CVE-2026-35616, Rapid7 on CVE-2026-41940, NetSPI on CVE-2026-41940, FortiGuard on CVE-2024-57727, Picus on the shadow copy IOCTL.

Read next

Back to the blog, or tell us about your system in the chat. Yaali, our AI agent, answers first and brings in an engineer.