An operational security slip by affiliates of two ransomware groups left a server exposed long enough for researchers to pull 8,257 AI-generated messages documenting how the operators ran intrusions, negotiated ransoms, and managed their victim pipeline. The logs, recovered from a directory at IP address 45.227.254.43, form one of the most detailed windows into how criminal groups are now deploying artificial intelligence to execute attacks at scale.
The research, published by SOCRadar, links the activity to affiliates of INC ransomware and The Gentlemen, a data extortion group. Analysts assess the operators are Russian-speaking and function both as an intrusion team and as an infrastructure provider, leasing out their toolkit to other ransomware partners.
The Framework Behind the Operation
At the center of the operation sits a custom platform called Phantom, described in its own documentation as an "Autonomous Red Team Kill Chain Framework." The tool ships with 18 skill modules, a routing engine, an autopilot orchestrator, and agents written in Python and Go. It connects to OpenCode, which lets the AI select attack techniques and assign tasks to remote agents. On victim machines, those agents masquerade as Windows Update components and phone home to a domain linked to the operation.
To run the AI components, operators routed prompts through OpenRouter, a commercial model aggregator, using legitimate AI models including Anthropic's claude-opus-4.6 and Moonshot AI's Kimi-K3. When models declined to help with a specific task, operators did not switch tools. They reframed the request as an "Authorized Red Team Assessment Request" and resubmitted it. That workaround appears frequently across the 133 recorded sessions.
Alongside Phantom, the group built WormGPT-MCP, a layer of 32 Model Context Protocol servers that tie the AI to purpose-built tools covering everything from reconnaissance to ransom negotiation. A partner guide found on a second server advertised "55+ tools" and access to more than 9,000 proof-of-concept exploits. The name WormGPT refers to a persona prompt layered over commercial models, not a separate AI system.
For persistence and communication, the group used Ghost C2, a family of three generations of polymorphic implants that route traffic through Cloudflare, Telegram, or DNS to avoid network-level detection.
How They Got In
The operation targeted exposed edge devices and widely used IT management software. Three vulnerabilities drove confirmed access: CVE-2024-57727, a path traversal flaw in SimpleHelp, gave the group admin passwords from 427 servers after scanning nearly 5,000; CVE-2026-35616, an authentication bypass in FortiClient EMS, allowed operators to create backdoor admin accounts across more than 4,000 managed endpoints; and CVE-2026-41940, an authentication bypass in cPanel and WHM, was used to reach small hosting providers and their clients' email servers.
Credential reuse turned single points of access into full-network compromises. In at least one documented case, a single reused password opened the door to a VPN, several servers, a remote management platform, backup infrastructure, and the organization's security management tools. To suppress endpoint detection tools, operators deployed a driver-based EDR killer that abused a vulnerable Zemana driver, a technique known as Bring Your Own Vulnerable Driver.
The Victim Picture
Researchers identified 62 named organizations in the operational logs, with 36 located in the United States. Industrial, manufacturing, and energy firms made up the largest share of targets at roughly 16 percent. Healthcare and pharmaceuticals came in second at about 14.5 percent. Most targeted companies were smaller businesses, with 27 of 35 classifiable organizations reporting revenue below $250 million. Some were reached indirectly through a managed service provider whose admin credentials had been stolen.
Four organizations ended up listed on public leak sites. The operation's timeline runs from mid-July 2026 through a live encryption event on September 30, 2026.
Extortion by the Numbers
The playbook prioritized data theft over encryption. Operators sifted through stolen financial records to gauge what a victim could pay, then opened contact with a text-only email carrying no ransom figure. Pressure escalated through scripted vishing calls, threats to notify customers and regulators, and hard deadlines of 24 to 72 hours before publication. Payment was planned in Monero, though researchers found no wallet or confirmed transaction records.
Demand figures from recovered case files show the range of the operation. A EUR 15 million demand sent to a company called Aidon was later revised down to EUR 4 million after the operators realized they had compromised the wrong parent company. A healthcare network in Australia received demands between AUD 3 million and AUD 8 million. The Gentlemen's communications to Leo Schachter Diamonds included a four-message sequence and a
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
Ransomware Affiliates Built an AI-Powered Attack Platform That Logged Its Own Crimes