{
 "id": "TR-2026-029",
 "status": "published",
 "title": "Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions",
 "date": "2026-10-23",
 "window": null,
 "ai_role": "attacker",
 "category": "incident",
 "summary": "SOCRadar researchers found exposed infrastructure belonging to affiliates of the INC and The Gentlemen ransomware groups, centred on an AI-driven framework called Phantom. Intrusions were executed through OpenCode with OpenRouter-hosted commercial models under a human-approved structure, where an operator supplied victim-specific prompts and reviewed each step. When models refused, the operator reframed requests as an authorized red team assessment. The agents supported exploitation of edge devices, lateral movement, credential harvesting, data exfiltration and AI-authored extortion.",
 "attacker": {
  "description": "Russian-speaking affiliates of the INC and The Gentlemen ransomware groups, using the Phantom AI framework with a human operator approving each step"
 },
 "defender": {
  "description": "About 62 targeted organizations, mainly in industrial, manufacturing, energy, healthcare and pharmaceutical sectors, more than half in the U.S."
 },
 "scale": "8,257 messages across 133 sessions; 62 organizations targeted; 4 listed on data leak sites; 18 Phantom skill modules; 32 MCP servers in WormGPT-MCP",
 "impact": "Data was stolen from victims and used for extortion, and four victims were listed on ransomware leak sites. Final ransom outcomes are unknown because no payment records were recovered.",
 "tactics": [
  "TA0001",
  "TA0002",
  "TA0003",
  "TA0005",
  "TA0006",
  "TA0007",
  "TA0008",
  "TA0009",
  "TA0010",
  "TA0011",
  "TA0040"
 ],
 "timeline": [
  {
   "date": "2026-10-23",
   "text": "SOCRadar's analysis of the exposed directory was reported, revealing the Phantom-driven intrusion ecosystem.",
   "tier": null,
   "source": "1"
  }
 ],
 "lessons": [],
 "models_named": [],
 "related_agents": [],
 "vendor_response": null,
 "sources": [
  {
   "title": "Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions",
   "url": "https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html",
   "outlet": "The Hacker News",
   "date": "2026-10-23"
  }
 ],
 "reviewer": "model: claude-sonnet-5-5 (automated review)",
 "checked_on": "2026-10-26"
}