AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations
Executive Summary
In October 2026, cybersecurity researchers at SOCRadar exposed a sophisticated AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. The operation centered on an autonomous framework called Phantom, which used OpenCode and commercial AI models via OpenRouter to execute human-approved but AI-automated kill chains. Attackers exploited edge devices including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways using multiple CVEs, then moved laterally, harvested credentials, and exfiltrated sensitive data via reverse-SOCKS tunnels before deploying ransomware. Approximately 62 organizations were targeted, with over 50% based in the United States, primarily across industrial, manufacturing, energy, healthcare, and pharmaceutical sectors.
This incident signals a structural shift in the ransomware threat landscape: AI agents are now operationalizing intrusion playbooks at machine speed while keeping humans in an approver role. The use of WormGPT-MCP, Ghost C2, and AI-curated victim knowledge bases indicates that agentic AI is rapidly becoming a standard component of ransomware-as-a-service toolkits, compressing attacker timelines and raising the bar for enterprise defenders.
Why This Matters Now
Ransomware affiliates have crossed a threshold: AI agents now autonomously execute multi-stage intrusions end-to-end, from initial exploitation through exfiltration, with human operators serving only as approvers. This eliminates traditional attacker skill bottlenecks, accelerates dwell time compression, and means any organization with exposed edge services or reused credentials is now a viable target regardless of sector or size. Defenders must assume AI-assisted adversaries and architect accordingly.
Attack Path Analysis
Russian-speaking ransomware affiliates operating under INC and The Gentlemen groups leveraged an AI-orchestrated framework (Phantom) to exploit public-facing edge devices at scale using known CVEs in FortiClient EMS, SimpleHelp, cPanel, and SonicWall appliances, gaining initial footholds across 62 organizations. After establishing access, operators enumerated domains, escalated privileges to domain admin via credential harvesting and BYOVD-based EDR impairment, pivoted laterally through reverse-SOCKS5 tunnels and RMM abuse, maintained persistent command-and-control over Cloudflare, Telegram, and DNS channels, exfiltrated prioritized financial and HR data, and ultimately deployed ransomware with AI-scripted extortion pressure backed by a 24-72 hour payment deadline.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited multiple actively exploited CVEs against internet-facing edge and remote-access systems including CVE-2024-57727 (SimpleHelp path traversal), CVE-2026-35616 (FortiClient authentication bypass), CVE-2026-41940 (cPanel/WHM authentication bypass), and CVE-2026-15409 (SonicWall SMA 1000 SSRF). The Phantom AI framework automated reconnaissance and exploit selection, with human operators reviewing and approving each intrusion step via OpenCode and OpenRouter-hosted commercial LLMs. Exploitation of edge appliances provided initial network footholds across industrial, manufacturing, energy, and healthcare sectors predominantly in the United States.
Related CVEs
CVE-2024-57727
CVSS 7.5A path traversal vulnerability in SimpleHelp remote support software allows an unauthenticated attacker to download arbitrary files from the server, potentially exposing sensitive configuration data and credentials.
Affected Products:
SimpleHelp SimpleHelp Remote Support – < 5.5.8
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Remote Services: SMB/Windows Admin Shares
Process Injection
Impair Defenses: Disable or Modify Tools
Exfiltration Over C2 Channel
Data Encrypted for Impact
Financial Theft
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Patch and Vulnerability Management for Public-Facing Systems
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Access Controls and Multi-Factor Authentication
Control ID: Section 500.7 / 500.12
DORA (Digital Operational Resilience Act) – ICT Incident Detection, Response, and Resilience Testing
Control ID: Article 10 – ICT-related Incident Management / Article 13 – Testing
NIS2 Directive – Supply Chain Security and Vulnerability Handling
Control ID: Article 21 – Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Device Security Enforcement
Control ID: Pillar 3: Networks – Macro/Micro Segmentation / Pillar 2: Devices – Endpoint Detection
HIPAA Security Rule – Access Control and Security Awareness for ePHI Systems
Control ID: 45 CFR § 164.312(a)(1) / § 164.308(a)(5)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Industrial Automation
Ransomware affiliates using AI-driven Phantom framework and BYOVD EDR killers are actively targeting industrial sectors, exploiting FortiClient and VPN edge devices to exfiltrate operational and financial data.
Health Care / Life Sciences
Healthcare and pharmaceutical organizations ranked second among confirmed targets, facing HIPAA compliance risk as ransomware affiliates prioritize credential harvest from finance, HR, and executive systems via lateral movement.
Oil/Energy/Solar/Greentech
Energy sector infrastructure faces elevated ransomware exposure as AI-orchestrated intrusions exploit edge VPN gateways and SonicWall SSRF vulnerabilities, threatening operational continuity and NIST CSF compliance obligations.
Financial Services
Operators explicitly harvest finance files and calculate victim payment thresholds using stolen financials, making financial services institutions high-value extortion targets requiring Zero Trust segmentation and egress enforcement.
Sources
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusionshttps://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.htmlVerified
- SimpleHelp Security Vulnerabilities Advisory - January 2025https://simple-help.com/kb---security-vulnerabilities-01-2025Verified
- CVE-2024-57727 Detail - NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-57727Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- SOCRadar: INC and The Gentlemen Ransomware AI Infrastructure Exposurehttps://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/Verified
- INC Ransomware Claims 830 Victims Since Launchhttps://thehackernews.com/2026/06/inc-ransomware-claims-830-victims-since.htmlVerified
- 54 EDR Killers Use BYOVD to Exploit 34 Drivershttps://thehackernews.com/2026/03/54-edr-killers-use-byovd-to-exploit-34.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers depended on unrestricted lateral reachability, permissive egress paths, and broad credential reuse to move across segmented zones and exfiltrate data at scale. A Zero Trust segmentation posture enforced across the cloud fabric would likely have constrained the blast radius across all 62 targeted organizations by limiting how far compromised edge credentials and reverse tunnels could reach into internal workloads.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Enforcing a CNSF perimeter posture would likely reduce the reachability of compromised edge devices into internal cloud workloads, limiting how much of the environment an initial foothold could meaningfully access even after exploitation succeeds.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what a single harvested credential could access, reducing the ability for one reused password to unlock disparate platform categories like VPN, RMM, and backup infrastructure simultaneously.
Control: East-West Traffic Security
Mitigation: East-west traffic controls enforced at the fabric level would likely reduce the ability of reverse SOCKS5 tunnels to traverse between workload segments freely, limiting how far lateral movement could propagate from an initial foothold without encountering a policy enforcement boundary.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized traffic control would likely surface anomalous outbound communication patterns to domain-fronted and covert protocol destinations, potentially reducing the dwell time of persistent C2 channels operating across Cloudflare, Telegram, and DNS over extended campaign periods.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls enforced at the fabric layer would likely constrain the outbound data transfer paths used to move staged files over reverse tunnels, potentially reducing the volume of financial and HR data successfully transferred to external infrastructure before detection.
Where prior Zero Trust controls constrained lateral movement and egress, the blast radius of ransomware deployment would likely be reduced to fewer workload segments, potentially leaving isolated zones intact and preserving partial recovery options where backup infrastructure remained unreachable to the attacker.
Impact at a Glance
Affected Business Functions
- Industrial Control Systems (ICS) and Operational Technology (OT) Networks
- Corporate Financial Planning and Accounts Payable
- Human Resources and Employee Records Management
- Healthcare Patient Records and Pharmaceutical Research Data
Estimated downtime: 18 days
Estimated loss: N/A
Sensitive corporate data exfiltrated across 62 targeted organizations spanning industrial, manufacturing, energy, healthcare, and pharmaceutical sectors. Stolen data categories include executive financial records, HR and employee personally identifiable information (PII), legal documents, and proprietary operational data. AI-driven triage prioritized finance, HR, legal, and executive files to calculate ransom demands calibrated to victim payment capacity. Four organizations were confirmed listed on ransomware data leak sites for INC and The Gentlemen groups. Credential harvesting via stealer tooling enabled lateral movement; in at least one confirmed case a single reused password unlocked VPN, servers, RMM, backup, and security management platforms simultaneously. No cryptocurrency payment records were recovered, leaving final ransom outcomes unconfirmed.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Native Security Fabric (CNSF) inline enforcement with real-time inspection at all internet-facing edge ingress points to detect and block AI-orchestrated exploit attempts against edge appliances such as FortiClient, SimpleHelp, cPanel, and SonicWall; anomalous automation patterns and repeated malformed requests should trigger automated policy responses before initial footholds are established.
- • Enforce Zero Trust Segmentation with identity-based microsegmentation policies across all workloads and service identities to ensure that credential reuse cannot propagate laterally across VPN, RMM, backup, and security management platforms simultaneously; smart group policies must enforce least-privilege access boundaries that contain blast radius from a single compromised credential.
- • Activate Multicloud Visibility and Control with centralized traffic observability to baseline normal east-west and control-plane communication patterns, enabling detection of anomalous interactions generated by Phantom's AI agent, RevSocks reverse-SOCKS pivots, and Ghost C2 Cloudflare- and DNS-tunneled beaconing before lateral spread completes.
- • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls to block unauthorized data staging and exfiltration destinations used by rks3 and BackupAgent tools, preventing the AI-curated prioritized file collections from reaching attacker-controlled infrastructure even when internal compromise has already occurred.
- • Deploy East-West Traffic Security controls with deep inspection of workload-to-workload flows combined with Inline IPS (Suricata) signature-based detection to identify reverse-SOCKS tunnel establishment, polymorphic implant beaconing over covert protocols, and known exploit payload signatures associated with the documented CVEs, reducing attacker dwell time and limiting progression from lateral movement to ransomware deployment.
