{
 "type": "bundle",
 "id": "bundle--ccd66f61-4c42-5f2d-ac1e-7fc92c6a6fb5",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--46a29915-ca52-5d25-9ed2-513562826585",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions",
   "description": "SOCRadar researchers found exposed infrastructure belonging to affiliates of the INC and The Gentlemen ransomware groups, centred on an AI-driven framework called Phantom. Intrusions were executed through OpenCode with OpenRouter-hosted commercial models under a human-approved structure, where an operator supplied victim-specific prompts and reviewed each step. When models refused, the operator reframed requests as an authorized red team assessment. The agents supported exploitation of edge devices, lateral movement, credential harvesting, data exfiltration and AI-authored extortion.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-029",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-029/"
    },
    {
     "source_name": "The Hacker News",
     "url": "https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html",
     "description": "Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--45882875-c1b0-544d-85c0-683dc1b8e405",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "Russian-speaking affiliates of the INC and The Gentlemen ransomware groups, using the Phantom AI framework with a human operator approving each step",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--654cd0dd-495c-5ce5-bddc-d8bd717c4465",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "About 62 targeted organizations, mainly in industrial, manufacturing, energy, healthcare and pharmaceutical sectors, more than half in the U.S.",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--83043a79-7b50-5a45-bb14-f2d983004285",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--16fe513d-e2be-5ded-9656-118512c6bd25",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0002 Execution",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0002"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--a9e47425-0d0c-502d-a95c-f45d5dc46005",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0003 Persistence",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0003"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--cf442ea9-d7e0-5ea5-a7d4-66e93f502665",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0005 Defense Evasion",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0005"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--6226d505-8e6e-51bd-922e-357d9ee61165",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0006 Credential Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0006"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--f554b87d-6974-547d-a59c-e845195c64e5",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0007 Discovery",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0007"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--88123f01-d876-57b5-a012-f7f19036cfa5",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0008 Lateral Movement",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0008"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--1b648259-43f0-52c5-a354-ca793b805ac5",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0009 Collection",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0009"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--f910acfd-85f8-5865-9150-44bd0d18f025",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0010 Exfiltration",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0010"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--66d26d5d-d2ca-595d-b64a-2d05e2b2f9c5",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0011 Command and Control",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0011"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--94c20391-8466-5bd5-8cd2-ab413c5663c5",
   "created": "2026-10-23T00:00:00.000Z",
   "modified": "2026-10-23T00:00:00.000Z",
   "name": "TA0040 Impact",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0040"
    }
   ]
  }
 ]
}