Ransomware Gangs Deployed AI Agents to Automate Network Intrusions

Security researchers have found exposed server logs showing that affiliates of two ransomware groups used AI agents to run attacks with little human oversight. The groups are INC and The Gentlemen ransomware. Their affiliates deployed a toolkit called Phantom, formally the Autonomous Red Team Kill Chain Framework. It let a single operator point the system at a target and have AI carry out the breach from start to finish.

Threat intelligence firm SOCRadar reported the discovery. The threat actors are Russian-speaking. They played two roles: attacking organizations directly, and selling infrastructure and services to other partners in the ransomware-as-a-service ecosystem, where criminal groups offer attack tools to outside affiliates for a cut of ransom payments.

Inside the exposed server

SOCRadar found a publicly accessible directory on a server that logged 8,257 messages across 133 sessions. That gave analysts a clear picture of how the operation ran. A human operator submitted a victim-specific prompt and reviewed each step. The AI then carried out the intrusion using OpenCode and commercial language models hosted on OpenRouter.

When a model refused a request, the operator rewrote it as an authorized red-team security test instead of switching models. That practice shows the group understood how AI safety filters work. It also points to a planned strategy for getting around them.

The operation used several connected tools. WormGPT-MCP linked the AI to 32 separate modules through Model Context Protocol servers. These are standardized connections that let AI systems use outside tools. The modules covered tasks from reconnaissance to drafting extortion messages. Ghost C2 was a set of polymorphic implants, meaning code that changes its shape to avoid detection. It talked to a remote server over Cloudflare, Telegram, or DNS and kept persistent access on infected machines.

RevSocks, a reverse SOCKS5 framework, let attackers tunnel through victim networks and stage files for removal. Other tools included QuickLine, a Cloudflare-fronted agent built on the Mythic penetration testing framework. There was also an EDR killer that loaded a legitimate but flawed Zemana driver to shut down security software. That technique is called bring-your-own-vulnerable-driver, or BYOVD. Two data-theft programs, rks3 and BackupAgent, handled final exfiltration.

How ransomware AI agents executed each autonomous intrusion

Every documented attack started at an internet-facing edge device. SOCRadar said the operators targeted FortiClient EMS gateways, Ivanti, Citrix, SonicWall, and OpenVPN gateways, SimpleHelp remote management servers, and cPanel web hosting controls. These are widely used systems, which made them productive targets for automated, large-scale exploitation.

After gaining entry, the attackers moved through the network. They escalated to domain administrator privileges where possible. They ran credential-harvesting tools to pull passwords and access tokens. Files from finance, HR, legal, and executive teams were the main targets. Data moved out through reverse-SOCKS tunnels before the group pushed toward ransomware deployment.

SOCRadar noted that "credential reuse was the main force multiplier" across the campaign. In one case, a single reused password opened a VPN, multiple servers, a remote monitoring platform, backup systems, and security management tools all at once. Security products were disabled using BYOVD techniques. The group's own logs showed uneven results against enterprise endpoint detection software.

Phantom acted as an orchestration layer. It communicated with an external server to receive tasks, ran commands on the target network, and returned results for review. That feedback loop let attacks adapt based on what the AI found at each step. The system also kept knowledge bases that tracked active victims, stored stolen credentials, and logged the status of multiple simultaneous attacks.

The extortion process

SOCRadar reviewed dozens of AI-written extortion records. The group took a data-driven approach to ransom amounts. Operators studied stolen financial records to estimate how much a target could pay without alerting a bank or insurer. They sent masked samples of stolen files as proof of access. Pressure escalated through scripted voice phishing calls, known as vishing, and threats to notify customers, partners, and regulators.

Victims who did not pay within a 24 to 72 hour deadline had their data published on a public leak site. Researchers found no cryptocurrency wallet addresses or payment records in the exposed infrastructure. The final outcomes of those ransom demands remain unknown.

Who was targeted

Researchers estimate that 62 organizations were targeted in the operation. Four ended up listed on the data leak sites for INC and The Gentlemen ransomware. The United States made up more than 50% of all targets. Industrial, manufacturing, and energy companies were hit most often. Healthcare and pharmaceutical organizations were also frequently targeted. The focus on sectors with sensitive operational data fits the group's financial analysis approach to setting ransom demands.

Why this signals a shift in attack scale

The Phantom framework supports 18 skill modules. They cover reconnaissance, binary reverse engineering, exploit research, steganography, telemetry analysis, and fingerprinting of endpoint detection tools. Combined with AI-managed victim tracking and machine-written extortion records, the toolkit shows how criminal groups can cut the skilled labor each attack normally requires.

Traditional ransomware campaigns depend on technically skilled operators managing each phase of a breach. The model SOCRadar documented changes that balance. One person can oversee multiple attacks at once. They submit prompts and approve key decisions while the AI handles reconnaissance, lateral movement, and extortion drafting. That structure lets a group run more attacks without adding more technical staff.

The use of mainstream commercial AI models through OpenRouter is also significant. It shows these capabilities are not limited to groups that build custom tools. Criminal actors can access the same AI services used by legitimate developers and redirect them through offensive frameworks. Reframing refused requests as authorized penetration tests highlights a broader problem: the line between a legitimate security framework and a criminal intrusion kit can be very thin when both draw on the same models.

What organizations can do

Every intrusion in this campaign began at an internet-facing edge device. These steps directly address the methods the group used:

• Patch FortiClient EMS, VPN gateways, SimpleHelp servers, and cPanel instances as soon as updates are available.
• Enforce unique passwords across all accounts. Require multi-factor authentication on every remote-access system.
• Test whether endpoint security tools can detect and block BYOVD attacks. Monitor for unexpected driver loads and review driver allow-lists regularly.
• Check network logs for reverse-SOCKS tunneling activity and unusual outbound connections through Cloudflare or Telegram.

The documented case of one reused password opening a VPN, servers, a monitoring platform, backup systems, and security tools all at once shows how far a single weak point can reach. Closing that gap is the most direct defense against the way this group operated.