Threat reportRansomwareTL-2026-3953
INC and The Gentlemen Ransomware: Exposed AI-Executed, Human-Approved Attack Infrastructure (Phantom framework)
INC and The Gentlemen Ransomware (TL-2026-3953), also tracked as Phantom framework, is a critical-severity ransomware operation, first published 2026-10-20. It is attributed to INC Ransom with medium confidence, affects Fortinet FortiClientEMS, references 8 CVEs (CVE-2026-35616, CVE-2024-57727, CVE-2026-41940), maps to 20 MITRE ATT&CK techniques (T1003.006, T1021.002, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 2INC Ransom
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3953
- Threat ID
- TL-2026-3953
- Also known as
- Phantom framework, Ghost C2
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- INC Ransom, The Gentlemen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- industrial, manufacturing, energy, health, pharmacy, hosting, government administration
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in INC and The Gentlemen Ransomware
Malware and tooling: INC Ransomware - S1139, inc ransom, Rclone - S1040, SimpleHelp
How INC and The Gentlemen Ransomware works
SOCRadar found seven exposed servers operated by affiliates of INC and The Gentlemen ransomware groups. Operators used commercial LLMs via OpenRouter to plan intrusions, generate commands and draft extortion materials, with a human approving each step. The servers held 46 staged INC encryptor builds, AI session logs and source code for a custom framework called Phantom.
SOCRadar's STRU team identified seven exposed servers (45.227.254.43, 45.227.254.45, 45.227.254.84, 179.60.149.68, 89.185.83.8, 138.124.113.210, 77.110.109.248), hosted largely on AS267784 (Flyservers S.A.), operated by affiliates of the INC and The Gentlemen ransomware groups. The servers exposed an 'AI-executed, human-approved' operating model: operators ran OpenCode against OpenRouter-hosted commercial models (anthropic/claude-opus-4.6 and moonshotai/kimi-k3) to plan intrusions, generate commands and draft extortion materials, while a human approved each step. Logs showed 8,257 messages across 133 OpenCode sessions and recorded API spend above $23,920. When models refused, operators reused 'Authorized Red Team Assessment Request' prompt templates. Operators were assessed as Russian-speaking, most active between 06:00 and 14:00 UTC.
The servers held source code for a custom framework called Phantom, described as a modular 'Autonomous Red Team Kill Chain Framework' with 18 skill modules, a routing engine, an autopilot orchestrator and Python and Go agents that disguise themselves as Windows Update components (callback api.iquickline.com). Other tooling included Ghost C2 (three generations of polymorphic implants over HTTPS via Cloudflare, Telegram and DNS, active since mid-July 2026), RevSocks (reverse SOCKS5), QuickLine (Athena/Mythic agent fronted by Cloudflare), a Quick Heal/Seqrite killer abusing the Zemana driver, the rks3 and BackupAgent exfiltration tools, and WormGPT-MCP (32 MCP servers including negotiation and pricing tools). Phishing used malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc.
Initial access relied on operator-reported exploitation of CVE-2026-35616 (FortiClient EMS; 2,236 targets, 108 created admins, 4,140 managed endpoints), CVE-2024-57727 (SimpleHelp; 242 unique IPs impacted, 427 admin passwords from 4,922 scans) and CVE-2026-41940 (cPanel/WHM; 49+ claimed hosting-provider breaches), plus CVE-2025-49113 (Roundcube). Exploits for further CVEs (ZeroLogon, PrintNightmare, PAN-OS CVE-2026-0300, FortiGate SAML CVE-2025-59718 and others) were attempted or developed. 46 staged INC encryptor builds decrypt the INC ransom note, and three INC leak-site victims match internal case files. A four-message extortion set signed 'The Gentlemen' was found in the Leo Schachter Diamonds case.
Victimology: 62 named organizations (36 in the United States). By stage, 4 were at public extortion (L5), 4 at encryption/extortion (L4), 14 at domain compromise (L3), 28 at foothold (L2) and 12 at reconnaissance (L1). Industrial/manufacturing/energy accounted for 16.1% and healthcare/pharma for 14.5%. Of 35 classifiable targets, 27 had revenue of $250M or less. Encryption of a live victim was screenshotted on 2026-09-30, and three INC packages were packed for a planned 2026-10-01 deployment wave. SOCRadar's confidence in a formal INC/Gentlemen alliance is low, while shared operational environment is moderate-to-high; the most plausible structure is a dedicated tooling and infrastructure provider. CVSS is not assigned to the campaign as a whole.
MITRE ATT&CK techniques used in TL-2026-3953
Credential Access
T1003.006 DCSync; T1558.003 Kerberoasting
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
Persistence
T1053.005 Scheduled Task; T1136 Create Account
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Impact
T1489 Service Stop; T1490 Inhibit System Recovery
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Resource Development
T1583.001 Domains; T1587.001 Malware
Reconnaissance
Affected products and versions in INC and The Gentlemen Ransomware
Remediation for INC and The Gentlemen Ransomware
Patches
- Patch FortiClient EMS (CVE-2026-35616)
- Upgrade SimpleHelp to 5.5.8 or later (CVE-2024-57727)
- Apply cPanel/WHM fixes for CVE-2026-41940
- Patch Fortinet and SonicWall gateways
Immediate actions
- Block the listed C2/staging IPs and domains at the perimeter and DNS
- Hunt for scheduled task RealtekAudioSvc and /assets/js/analytics.js loader paths
- Hunt for Remote Registry started before RDP enablement, replication requests from non-DC hosts, ntds.dit shadow copies and RC4 Kerberos spikes
- Alert on restic/rclone execution and bulk uploads to object storage
- Rotate admin credentials on SimpleHelp, FortiClient EMS and cPanel/WHM systems and review for rogue admin accounts
Workarounds
- Restrict management interfaces of FortiClient EMS, SimpleHelp and cPanel/WHM to trusted networks
Longer-term hardening
- Enforce MFA on MSP and RMM environments
- Retire Windows Server 2008 R2 domain controllers; deploy LAPS and gMSAs
- Protect backups with immutable or air-gapped storage
- Enable EDR tamper protection and enforce vulnerable driver blocklists
CVEs associated with INC and The Gentlemen Ransomware
CVE-2026-35616, CVE-2024-57727, CVE-2026-41940, CVE-2025-49113, CVE-2020-1472, CVE-2026-0300, CVE-2021-1675, CVE-2025-59718
Weaknesses (CWE) in INC and The Gentlemen Ransomware
Timeline of INC and The Gentlemen Ransomware
- CVE-2024-57727 (SimpleHelp path traversal) published; CISA added it to KEV on 2025-02-13
- CVE-2026-35616 (FortiClientEMS improper access control, CVSS 9.8) published
- CVE-2026-41940 (cPanel/WHM authentication bypass, CVSS 9.8) published; added to CISA KEV on 2026-04-30
- Ghost C2 activity begins (mid-July 2026, per SOCRadar)
- Live victim encryption screenshot recovered; three INC packages packed for deployment
- Planned INC deployment wave using 46 staged encryptor builds
- Operator checked OpenRouter account balance, which was nearly exhausted
- SOCRadar published analysis of the seven exposed servers and the Phantom framework
Sources cited for INC and The Gentlemen Ransomware
- INC and The Gentlemen Ransomware: Exposed AI Infrastructure (SOCRadar STRU)
- NVD: CVE-2026-35616 (FortiClientEMS)
- NVD: CVE-2026-41940 (cPanel & WHM)
- NVD: CVE-2024-57727 (SimpleHelp)
- CISA Known Exploited Vulnerabilities Catalog
- SOCRadar Dark Web Profile: INC Ransom
- Intel 471: INC Ransomware
- The Hacker News: INC Ransomware Claims 830 Victims
Detection coverage for TL-2026-3953
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3953 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3953
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.