# INC and The Gentlemen Ransomware: Exposed AI-Executed, Human-Approved Attack Infrastructure (Phantom framework)

> SOCRadar found seven exposed servers operated by affiliates of INC and The Gentlemen ransomware groups. Operators used commercial LLMs via OpenRouter to plan intrusions, generate commands and draft extortion materials, with a human approving each step. The servers held 46 staged INC encryptor builds, AI session logs and source code for a custom framework called Phantom.

- **Published:** 2026-10-20T11:39:11Z
- **Last reviewed:** 2026-10-20T11:39:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3953
- **ID:** TL-2026-3953
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** INC Ransom
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616, CVE-2024-57727, CVE-2026-41940, CVE-2025-49113, CVE-2020-1472, CVE-2026-0300, CVE-2021-1675, CVE-2025-59718

## Description

SOCRadar's STRU team identified seven exposed servers (45.227.254.43, 45.227.254.45, 45.227.254.84, 179.60.149.68, 89.185.83.8, 138.124.113.210, 77.110.109.248), hosted largely on AS267784 (Flyservers S.A.), operated by affiliates of the INC and The Gentlemen ransomware groups. The servers exposed an 'AI-executed, human-approved' operating model: operators ran OpenCode against OpenRouter-hosted commercial models (anthropic/claude-opus-4.6 and moonshotai/kimi-k3) to plan intrusions, generate commands and draft extortion materials, while a human approved each step. Logs showed 8,257 messages across 133 OpenCode sessions and recorded API spend above $23,920. When models refused, operators reused 'Authorized Red Team Assessment Request' prompt templates. Operators were assessed as Russian-speaking, most active between 06:00 and 14:00 UTC.

The servers held source code for a custom framework called Phantom, described as a modular 'Autonomous Red Team Kill Chain Framework' with 18 skill modules, a routing engine, an autopilot orchestrator and Python and Go agents that disguise themselves as Windows Update components (callback api.iquickline.com). Other tooling included Ghost C2 (three generations of polymorphic implants over HTTPS via Cloudflare, Telegram and DNS, active since mid-July 2026), RevSocks (reverse SOCKS5), QuickLine (Athena/Mythic agent fronted by Cloudflare), a Quick Heal/Seqrite killer abusing the Zemana driver, the rks3 and BackupAgent exfiltration tools, and WormGPT-MCP (32 MCP servers including negotiation and pricing tools). Phishing used malicious Word templates and HTML smuggling, persisting through a scheduled task named RealtekAudioSvc.

Initial access relied on operator-reported exploitation of CVE-2026-35616 (FortiClient EMS; 2,236 targets, 108 created admins, 4,140 managed endpoints), CVE-2024-57727 (SimpleHelp; 242 unique IPs impacted, 427 admin passwords from 4,922 scans) and CVE-2026-41940 (cPanel/WHM; 49+ claimed hosting-provider breaches), plus CVE-2025-49113 (Roundcube). Exploits for further CVEs (ZeroLogon, PrintNightmare, PAN-OS CVE-2026-0300, FortiGate SAML CVE-2025-59718 and others) were attempted or developed. 46 staged INC encryptor builds decrypt the INC ransom note, and three INC leak-site victims match internal case files. A four-message extortion set signed 'The Gentlemen' was found in the Leo Schachter Diamonds case.

Victimology: 62 named organizations (36 in the United States). By stage, 4 were at public extortion (L5), 4 at encryption/extortion (L4), 14 at domain compromise (L3), 28 at foothold (L2) and 12 at reconnaissance (L1). Industrial/manufacturing/energy accounted for 16.1% and healthcare/pharma for 14.5%. Of 35 classifiable targets, 27 had revenue of $250M or less. Encryption of a live victim was screenshotted on 2026-09-30, and three INC packages were packed for a planned 2026-10-01 deployment wave. SOCRadar's confidence in a formal INC/Gentlemen alliance is low, while shared operational environment is moderate-to-high; the most plausible structure is a dedicated tooling and infrastructure provider. CVSS is not assigned to the campaign as a whole.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.001 Domains
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566.001 Spearphishing Attachment
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1136 Create Account
- T1036 Masquerading
- T1003.006 DCSync
- T1558.003 Kerberoasting
- T1021.002 SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1090 Proxy
- T1572 Protocol Tunneling
- T1567.002 Exfiltration to Cloud Storage
- T1489 Service Stop
- T1490 Inhibit System Recovery

## Sources

- [INC and The Gentlemen Ransomware: Exposed AI Infrastructure (SOCRadar STRU)](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/)
- [NVD: CVE-2026-35616 (FortiClientEMS)](https://nvd.nist.gov/vuln/detail/CVE-2026-35616)
- [NVD: CVE-2026-41940 (cPanel & WHM)](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
- [NVD: CVE-2024-57727 (SimpleHelp)](https://nvd.nist.gov/vuln/detail/CVE-2024-57727)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [SOCRadar Dark Web Profile: INC Ransom](https://socradar.io/blog/dark-web-profile-inc-ransom/)
- [Intel 471: INC Ransomware](https://www.intel471.com/blog/inc-ransomware)
- [The Hacker News: INC Ransomware Claims 830 Victims](https://thehackernews.com/2026/06/inc-ransomware-claims-830-victims-since.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3953