Ransomware Crews Are Using AI Agents to Run Intrusions — And Someone Left the Logs Exposed
A misconfigured server has handed cybersecurity researchers a rare window into a sophisticated ransomware operation that has been using AI agents to automate its attacks. The group, believed to be Russian-speaking, operates as affiliates of both the INC and The Gentlemen ransomware gangs, and apparently moonlights as an infrastructure provider for other crews in the ransomware ecosystem.
The centrepiece of the operation is something they've called Phantom: an "Autonomous Red Team Kill Chain Framework" that handles the dirty work of intrusion while a human operator watches over proceedings and approves each step. Think less Skynet, more a very attentive manager who lets the AI do the typing.
SOCRadar found an exposed directory at 45.227.254[.]43 containing logs of 8,257 messages across 133 sessions. The setup runs through OpenCode with commercial AI models hosted via OpenRouter. When a model refuses to play ball with an obviously malicious prompt, the operator simply reframes it as an authorised red team exercise. Apparently that works often enough to be worth trying.
The group gets its initial foothold by hammering public-facing edge devices at scale, then works through a fairly standard but effective playbook: lateral movement, credential harvesting, persistence, data exfiltration, and eventually ransomware deployment. The vulnerabilities they've been exploiting or developing for include CVE-2024-57727, a path traversal flaw in SimpleHelp; an authentication bypass in Fortinet FortiClient; a similar bypass in cPanel/WHM; an SSRF in SonicWall SMA 1000; and SQL injection issues in LiteLLM and Drupal. Some of these are actively being exploited, others appear to be in development or staged for future use.
Once inside a network, the pattern is consistent. Enumerate the domain, escalate to domain admin where possible, hoover up credentials using stealer tooling, and prioritise finance, HR, legal, and executive files. Data gets staged and pulled out over reverse-SOCKS tunnels.
Credential reuse is doing a lot of heavy lifting here. SOCRadar noted one case where a single reused password unlocked a VPN, multiple servers, an RMM platform, backup systems, and security management tools simultaneously. Security software gets dealt with using a Bring Your Own Vulnerable Driver technique, specifically abusing the Zemana driver to kill EDR products, though their own logs suggest enterprise endpoint detection gave them a harder time than expected.
The toolkit is extensive. Phantom itself supports 18 modules covering reconnaissance, exploit research, EDR fingerprinting, binary reverse engineering, and steganography. Alongside it sits WormGPT-MCP, a collection of 32 Model Context Protocol servers connecting the AI system to an equivalent number of functional modules spanning the full attack lifecycle. Ghost C2 provides three generations of polymorphic implants that communicate over Cloudflare, Telegram, or DNS. RevSocks handles network pivoting and data staging. There's also a Cloudflare-fronted Mythic agent called QuickLine, and exfiltration tools named rks3 and BackupAgent.
The extortion side is equally methodical and, frankly, unpleasant. AI-generated extortion records show the group analyses stolen financial data to figure out exactly how much a victim can pay without needing to involve a bank or insurer. Victims receive redacted proof samples and then get hit with scripted vishing calls. Threats to notify customers, regulators, and business partners are deployed to increase pressure. If payment doesn't arrive within a 24 to 72 hour window, the data goes public on the leak site.
Around 62 organisations are believed to have been targeted in total, with four confirmed listings across the INC and The Gentlemen data leak sites. More than half the targets are US-based. Industrial, manufacturing, and energy sectors took the brunt of it, with healthcare and pharmaceuticals also featuring prominently.
No cryptocurrency wallets or payment records were recovered, so whether any of the ransom demands actually succeeded remains unknown. What is clear is that AI-assisted intrusion operations are no longer theoretical. This one was running at scale, keeping detailed notes, and nearly got away without anyone noticing.