Cybersecurity researchers at SOCRadar have uncovered an AI-driven ransomware operation linked to affiliates of the INC and The Gentlemen groups, centred around a framework called "Phantom" that uses commercial AI models to autonomously execute intrusions while a human operator reviews each step. The threat actors, assessed to be Russian-speaking, exploit vulnerabilities in edge devices and remote-access systems at scale, then move laterally to harvest credentials, exfiltrate sensitive data, and deploy ransomware, with credential reuse serving as a key force multiplier. Approximately 62 organisations have been targeted — predominantly in the US across industrial, manufacturing, energy, and healthcare sectors — with AI also used to analyse victims' financials and craft tailored extortion demands.
