Ransomware operators used commercial AI tools to help plan intrusions, manage victim information and prepare extortion, according to a new investigation.
But the systems they relied on also kept detailed records of their work. A publicly accessible server exposed AI chat sessions, stolen credentials, campaign notes and source code, giving researchers a view into the operators’ workflow.
The exposed files linked the activity to affiliates operating with INC Ransomware and The Gentlemen Ransomware. They included 46 INC encryptor builds prepared for six victims and evidence that an encryptor had run on a victim’s computer.
The researchers cautioned that the records showed organizations at different stages: some were only listed for reconnaissance, while others had deeper access or had reached extortion. SOCRadar’s technical report describes the findings in detail.
Analysts from the SOCRadar Threat Research Unit (STRU) identified the exposed infrastructure in late September 2026. The team found one open server containing AI session data, a shared knowledge base and code for a framework called Phantom.
Logs, configuration files and credentials on that server led researchers to six more exposed servers. Together, the systems held records of victim activity, tools, malware and extortion plans.
Hackers Use Claude AI to Plan Ransomware Attacks
The operators used OpenCode as an interface to models hosted through OpenRouter. STRU reviewed 8,257 messages across 133 sessions and found that the AI helped plan reconnaissance, select techniques, generate commands, troubleshoot tools, review stolen data and draft extortion material.
Claude Opus 4.6 and Kimi K3 were among the commercial models named in the report; the findings describe an AI-supported operation, not proof that Claude alone carried out every task.
Ecosystem overview (Source – SOCRadar)
Human operators remained involved. The AI was told to coordinate actions and wait for approval, making the setup closer to a human-directed assistant than an independent system.
When a model refused a request, an operator sometimes rewrote it as an authorized red-team assessment. The operators also used a “WormGPT” persona prompt, but STRU says this was a prompt label, not evidence that they were using a separate uncensored model.
The system’s memory became a major weakness. Its knowledge base tracked victims, credentials and campaign progress, while the chat logs showed how operators planned and adjusted their work.
Recorded AI spending exceeded $23,920, according to SOCRadar’s account records. The exposure turned those private work notes into evidence that investigators could examine.
Edge systems were a key way in
Operator records describe attempts to gain access through internet-facing management and remote-access products. They report exploitation of FortiClient EMS flaw CVE-2026-35616, SimpleHelp flaw CVE-2024-57727 and cPanel/WHM flaw CVE-2026-41940.
These figures come from the operators’ own records and were not independently verified by STRU. For SimpleHelp, the records claim 242 affected IP addresses; the earlier SimpleHelp vulnerability report explains why flaws in remote support tools can put connected customer networks at risk.
CISA has separately warned that ransomware actors have exploited CVE-2024-57727 in unpatched SimpleHelp systems. The agency urged organizations to update vulnerable instances and check for signs of compromise, including where a service provider’s system connects to customer environments.
Attackers in the SOCRadar investigation also reportedly used stolen or reused credentials to move between systems. In one case, a reused password opened access to multiple services, including remote access, servers and backup tools.
Tooling overview (Source – SOCRadar)
After getting inside, the operators searched networks, gathered credentials and focused on finance, human resources, legal and executive files. The exposed toolkit included Phantom, Ghost command-and-control software and RevSocks, which can tunnel traffic.
Researchers also found a tool designed to interfere with some security products. The report says the operators prepared INC encryptors for Windows and Linux, but the planned October 1, 2026 deployment against those targets was not confirmed. A September 30 screenshot did show an encryptor running in a victim environment.
The records suggest that stealing data and threatening to publish it could matter as much as encrypting files. Operators used victim financial and customer information to shape demands and plan pressure, including scripted calls.
This broader shift toward data theft and threats is also seen in other cases; Cybersecurity News has reported on ransomware extortion without encryption.
SOCRadar linked the exposed systems to activity involving both INC and The Gentlemen, but did not conclude that the two groups had a formal alliance.
The researchers considered a shared operational environment or service provider supporting different ransomware partners a more likely explanation.
Their records named 62 organizations, but only four were publicly listed for extortion; others were at earlier stages, including reconnaissance or initial access.
For defenders, the case highlights the need to patch exposed edge and remote-access systems, restrict management interfaces, use multifactor authentication for remote administration and review accounts and VPN settings for unexpected changes.
Organizations should also protect backups from direct access by compromised accounts and monitor remote-management tools and large outbound transfers.
The incident’s central lesson is straightforward: AI can help criminals coordinate complex work, but poorly secured infrastructure and retained logs can expose the operation behind it.
Indicators of compromise (IoCs):-
TypeIndicatorNoteIP45.227.254[.]43OpenCode, knowledge base and PhantomIP179.60.149[.]68Staging and pivotIP45.227.254[.]45Build and deployment hubIP45.227.254[.]84Kali / VM hostIP77.110.109[.]248RevSocks hostIP89.185.83[.]8Ghost / deliveryIP138.124.113[.]210Ghost panelDomainsystem-strategy[.]orgGhost / Phantom redirector zoneDomainiquickline[.]comPhantom / Athena C2 zoneDomainmcgrawney[.]comPhantom redirector zoneDomaindriverupdate[.]appRetired C2 zoneDomainstackpathcloud[.]comRetired C2 zoneDomaincloud-update[.]liveMeshCentral C2 frontDomainbossprotect[.]comMail / phishing domainDomaintrulitesupport[.]comLook-alike customer notice pageDomainincblog[.]suINC leak-site mirrorOnionincpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid[.]onionINC payment portalOnionincblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onionINC leak siteOnionincblog4uttkxd6b4grii6k2qcj2tn5k37seep5xto3dlghyqla7u7qd[.]onionINC site snapshotOnionincadmd42ytgp4hwkejirji4m6pcbacazoeic7fc5sd27nr7it5ajyqd[.]onionINC dashboard / chatOnionz26qmezqaixjp3k6spvdpool4us6m3ei453f7wgl7gouojmp2ttkdgad[.]onionLegacy Rocket.Chat hidden serviceURL path/assets/js/analytics.jsDisguised loader pathSHA-256ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4INC build ASHA-2560ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5INC build BSHA-25614b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212INC build CSHA-256ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463eINC kit 1, WindowsSHA-256ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebbINC kit 2, WindowsSHA-256ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918INC kit 3, WindowsSHA-25670f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82INC kit 1, LinuxSHA-2567ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20INC kit 2, LinuxSHA-2564286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885aINC kit 3, Linux
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
——————————————————–
Click Here For The Original Source.
