Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
It was to be expected, and it has arrived. Cybercriminals are moving to a new attack model in which artificial intelligence becomes not only an assistant to the attacker, but a tool to manage almost the entire penetration chain in corporate infrastructure. This is reported by the researchers at SOCRadar, who discovered an attack ecosystem involving affiliates of the INC and The Gentlemen groups that use artificial intelligence to hack networks, steal data and prepare subsequent extortions.
At the core of this infrastructure is Phantom, an autonomous Red Team framework running on OpenCode and commercial language models accessible via OpenRouter. The operator sets the objectives and controls the system’s actions, but the actual invasion phases are carried out by artificial‑intelligence agents. Thus, a person determines the attack direction while the AI takes on a significant portion of the technical work.
The researchers found logs containing 8,257 messages across 133 sessions. If the model refused to comply with a request, the operator re‑phrased it as an authorized penetration‑testing activity.
The attackers gain initial access through Internet services and vulnerable peripheral devices, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways. Their arsenal includes actively exploited vulnerabilities such as the classic CVE‑2024‑57727, CVE‑2026‑35616 and CVE‑2026‑41940. Other flaws, including those related to SonicWall, WordPress, LiteLLM and Drupal, have been studied, developed for exploitation, or mentioned in operator materials.
Once inside, the system helps explore the domain infrastructure, collect credentials, search for domain administrator privileges and navigate between nodes. Particular attention is given to financial documents, human‑resources data, legal material and managerial information. Reverse SOCKS tunnels are used to transfer files.
Additional tools provide operation scaling. WormGPT‑MCP integrates 32 Model Context Protocol servers that connect the AI with various modules, from intelligence to extortion. Ghost C2 includes three generations of polymorphic malware that communicate via Cloudflare, Telegram or DNS. RevSocks is used to move through compromised networks and prepare data for exfiltration.
A separate task is to neutralize protective measures. The attackers employ BYOVD techniques, allowing them to use vulnerable drivers to bypass security systems, as well as special boot‑loader‑level bypass mechanisms. However, the effectiveness of these methods against corporate EDRs has varied.
The most alarming shift is the move from automating individual actions to automating the entire intrusion process. Artificial intelligence helps identify targets, analyze infrastructure, use credentials, gain a foothold in the network and prepare information theft. Humans are still involved in executing the operation, but the scope of actions performed by the agents greatly expands the criminals’ capabilities.
Once the data are stolen, personalized extortion begins. By analyzing the victim’s financial information, the attackers try to determine the amount the organization can pay without involving a bank or insurance company. Pressure is heightened by fabricated evidence, prepared invitations and threats to disclose information to customers, partners and regulators. If the victim does not pay within 24–72 hours, the stolen data may be published on a leak site.
Researchers estimate the operation has hit 62 organizations, four of which appeared on the INC and The Gentlemen data‑leaks site. More than half of the targets were in the United States. The most affected sectors include manufacturing, energy, as well as health and pharmaceutical.
The final ransomware outcomes are unknown: researchers were unable to locate cryptocurrency wallets or verified payment pathways.
This campaign shows how the very nature of ransomware attacks is changing. It is no longer just malware that encrypts files after penetration. An infrastructure is forming where artificial intelligence helps orchestrate an intrusion, tailor actions to a specific victim and ready its data for ransom. The next frontier is even greater autonomy of such operations, where human intervention will be required only to set targets and make key decisions.
