A directory left readable on a server at 45.227.254[.]43 documented 8,257 messages spread across 133 sessions of ransomware preparation. SOCRadar found inside it an intrusion service built on agentic AI, run by affiliates of INC and The Gentlemen.
The operator calls the core component Phantom, an “Autonomous Red Team Kill Chain Framework.” Judging by the tooling and its Russian-language artifacts, the actor is Russian-speaking and sells capability to other crews as well as running break-ins.
Human approves, the model executes
Each intrusion starts with a person writing a victim-specific prompt. From there the work runs through OpenCode driving commercial models hosted by OpenRouter, with a human reviewing every step – an AI-executed, human-approved structure.
When a model refused a request, the operator rewrote it as a sanctioned red team exercise rather than switching to a different model. Phantom supports 18 skill modules covering reconnaissance, reverse engineering, exploit research, steganography and EDR fingerprinting. A pack of 32 Model Context Protocol servers called WormGPT-MCP connects it to functions from recon through extortion.
The targets are unpatched edge devices
Records show exploitation of several flaws at scale: CVE-2024-57727 in SimpleHelp, CVE-2026-35616 in FortiClient, plus a cPanel authentication bypass and a SonicWall SMA 1000 SSRF staged for later use.
Next comes domain enumeration, escalation to domain administrator, credential harvesting, and collection of finance, HR, legal and executive files over reverse SOCKS tunnels. In one intrusion a single reused password opened the VPN, servers, RMM, backup and security consoles at once. A bring-your-own-vulnerable-driver tool was used against endpoint agents.
The defensive conclusion is unglamorous: patch edge appliances, stop reusing credentials, and treat RMM reachability as a privilege decision.
