Threat reportRansomwareTL-2026-4020
INC Ransomware Operators Use Claude AI and Phantom Framework; Exposed Data Shows 8,257 Messages and 46 Victim-Specific Encryptor Builds (CVE-2026-35616, CVE-2024-57727, CVE-2026-41940)
INC Ransomware Operators Use Claude AI and Phantom (TL-2026-4020), also tracked as Phantom framework, is a critical-severity ransomware operation, first published 2026-10-21. It is attributed to INC Ransomware affiliates with medium confidence, affects Fortinet FortiClient EMS, references 3 CVEs (CVE-2026-35616, CVE-2024-57727, CVE-2026-41940), maps to 25 MITRE ATT&CK techniques (T1003.003, T1003.006, T1021.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 25MITRE ATT&CK
- Actors
- 1INC Ransomware affiliates
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4020
- Threat ID
- TL-2026-4020
- Also known as
- Phantom framework, Ghost C2, QuickLine
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- INC Ransomware affiliates
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, industrial, energy, health, pharmacy, local-government, retail, hosting
- Target regions
- North America, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in INC Ransomware Operators Use Claude AI and Phantom
Malware and tooling: Ghost C2, INC Ransomware - S1139, inc ransom, phantom, Chisel, MeshCentral, Quick Heal/Seqrite security killer, RevSocks, SimpleHelp
How INC Ransomware Operators Use Claude AI and Phantom works
SOCRadar Threat Research Unit analyzed exposed infrastructure showing INC ransomware affiliates (with shared tooling linked to The Gentlemen group) using OpenCode with OpenRouter-hosted Claude Opus 4.6 and Kimi K3, plus a custom 'Phantom' kill-chain framework, for AI-assisted reconnaissance and command generation. Recovered data includes 8,257 AI messages across 133 sessions, 46 victim-specific INC encryptor builds and 62 named victim organizations, with initial access via FortiClient EMS, SimpleHelp and cPanel/WHM vulnerabilities.
In late September 2026 SOCRadar investigators found open directories on a cluster of seven servers (mostly AS267784, Flyservers S.A.) that exposed the working environment of a ransomware tooling operation. The environment held an OpenCode interface backed by OpenRouter-hosted models (Claude Opus 4.6 and Kimi K3), three iterations of persistent knowledge bases tracking victims, credentials and campaign progress, 32 WormGPT-labelled MCP servers, and 'Phantom', a self-described 'Modular Autonomous Red Team Kill Chain Framework' with 18 skill modules, an autopilot mode and Python/Go agents masquerading as Windows Update. Operators framed prompts as an 'Authorized Red Team Assessment' to get around model refusals; actions were reported to require human approval at each step. One OpenRouter account had spent more than $23,920; 8,257 messages across 133 sessions were recovered. The operators were assessed as Russian-speaking and active roughly 06:00-14:00 UTC.
Initial access relied on FOFA-driven scanning for exposed FortiClient EMS, SimpleHelp, mail and VPN hosts and exploitation of three vulnerabilities. CVE-2026-35616 is a FortiClient EMS pre-authentication API access-control bypass (affecting 7.4.5 and 7.4.6; exploitation first seen by watchTowr honeypots on 2026-03-31 and confirmed by Fortinet with hotfixes on 2026-04-04); the operators claimed 108 administrator accounts across 2,236 EMS targets. CVE-2024-57727 is an unauthenticated SimpleHelp path-traversal (CWE-22, SimpleHelp 5.5.7 and earlier, CISA KEV since 2025-02-13); the data shows 427 admin passwords harvested from 242 unique IPs. CVE-2026-41940 is a cPanel & WHM CRLF-injection authentication bypass (reportedly exploited since about late February 2026 before the patch); 49+ cPanel breaches were claimed. Spearphishing with malicious .dotm template injection, LNK-in-ZIP and HTML smuggling, plus vishing scripts, were also prepared. Failed or attempted exploits included ZeroLogon (CVE-2020-1472, used against two domain controllers), PrintNightmare (CVE-2021-1675, failed), Roundcube CVE-2025-49113, PAN-OS User-ID overflow and a FortiGate SAML bypass.
Post-exploitation used Ghost C2 (three polymorphic implant generations communicating over HTTPS via Cloudflare, Telegram and DNS; staging since mid-July 2026), the QuickLine Cloudflare-fronted Mythic/Athena agent, RevSocks reverse SOCKS5 tunnels alongside Chisel and Ligolo-ng, MeshCentral agents, NetExec for SMB admin-share movement, RDP, and credential reuse (one password unlocked VPN, servers, RMM and backup platform). Persistence included a scheduled task named RealtekAudioSvc running svc.py. A Quick Heal/Seqrite security killer abused a vulnerable Zemana driver (BYOVD), with mixed results against enterprise EDR. Data was exfiltrated with restic, rclone, rks3 and BackupAgent to cloud object storage.
The 46 victim-specific INC encryptors (Rust-based, Windows and Linux) append the .INC extension, drop INC-README.txt pointing to a Tor chat portal, stop backup and database services, delete shadow copies through direct driver calls (IOCTL 0x53C028) rather than vssadmin, and offer a quiet mode that restores last-write timestamps. Three encryptor packages were prepared on 2026-09-30 for a deployment planned for 2026-10-01. Of 62 named organizations (36 in the US), 4 were publicly extorted, 4 were at the encryption/extortion stage, 14 had domain compromise, 28 a foothold and 12 reconnaissance only; industrial/manufacturing (16.1%) and healthcare/pharma (14.5%) led the sector mix. SOCRadar rates a formal INC/Gentlemen alliance at low confidence but a shared operational environment at moderate-to-high confidence, assessing the operator as a dedicated tooling and infrastructure provider serving multiple ransomware partners. Claimed victim counts are unverified operator data. CVSS for the campaign is not stated; component CVEs: CVE-2026-35616 CVSS 9.1, CVE-2026-41940 CVSS 9.8, CVE-2024-57727 CVSS 7.5. The GBHackers report is a secondary summary of the SOCRadar publication.
MITRE ATT&CK techniques used in TL-2026-4020
Credential Access
T1003.003 NTDS; T1003.006 DCSync; T1555.003 Credentials from Web Browsers; T1558.003 Kerberoasting
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027.006 HTML Smuggling; T1036 Masquerading; T1070.006 Timestomp; T1221 Template Injection
Persistence
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Command and Control
T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Reconnaissance
T1591 Gather Victim Org Information; T1595.002 Vulnerability Scanning
defense-impairment
Affected products and versions in INC Ransomware Operators Use Claude AI and Phantom
- Fortinet — FortiClient EMS
Vulnerable versions: 7.4.5; 7.4.6
Fixed in: Hotfix for 7.4.5/7.4.6; 7.4.7 - SimpleHelp — SimpleHelp remote support server
Vulnerable versions: 5.5.7 and earlier
Fixed in: 5.5.8; 5.4.10; 5.3.9 - cPanel — cPanel & WHM / WP Squared
Vulnerable versions: All versions after 11.40; WP Squared 136.1.7
Fixed in: Vendor-patched builds per cPanel advisory
Remediation for INC Ransomware Operators Use Claude AI and Phantom
Patches
- FortiClient EMS hotfix for 7.4.5/7.4.6, fixed in 7.4.7
- SimpleHelp 5.5.8 / 5.4.10 / 5.3.9
- Vendor-patched cPanel & WHM build for CVE-2026-41940
Immediate actions
- Patch or hotfix FortiClient EMS 7.4.5/7.4.6 for CVE-2026-35616 and review EMS for unexpected administrator accounts
- Upgrade SimpleHelp to 5.5.8 (or 5.4.10/5.3.9 patched branches) for CVE-2024-57727 and rotate all technician and admin passwords stored on the server
- Patch cPanel & WHM for CVE-2026-41940, restart cpsrvd, and restrict ports 2083, 2087, 2095 and 2096 to trusted sources
- Block and hunt for the listed IPs and domains; alert on Cloudflare-fronted and Telegram/DNS beaconing from servers
- Hunt for the RealtekAudioSvc scheduled task running svc.py, .INC file extensions and INC-README.txt
Workarounds
- Block inbound access to cPanel ports 2083/2087/2095/2096 and stop cpsrvd/cpdavd until patched
- Restrict FortiClient EMS and SimpleHelp management interfaces to internal networks
Longer-term hardening
- Remove management consoles (EMS, SimpleHelp, cPanel/WHM) from direct internet exposure and put them behind VPN/ZTNA with MFA
- Eliminate password reuse across VPN, servers, RMM and backup platforms; enforce unique privileged credentials and tiered administration
- Enable vulnerable-driver blocklisting (Microsoft recommended driver block rules / HVCI) to blunt Zemana-based BYOVD
- Maintain offline, immutable backups and monitor for restic/rclone-style bulk exfiltration to cloud object storage
- Patch Active Directory against ZeroLogon (CVE-2020-1472) and PrintNightmare (CVE-2021-1675)
CVEs associated with INC Ransomware Operators Use Claude AI and Phantom
Weaknesses (CWE) in INC Ransomware Operators Use Claude AI and Phantom
Timeline of INC Ransomware Operators Use Claude AI and Phantom
- Ransomware actors begin exploiting unpatched SimpleHelp RMM servers (CVE-2024-57727), per CISA AA25-163A reporting
- CISA adds CVE-2024-57727 (SimpleHelp path traversal) to the Known Exploited Vulnerabilities catalog
- Exploitation of cPanel & WHM authentication bypass CVE-2026-41940 reportedly begins around late February, months before a patch
- watchTowr honeypots record first exploitation attempts against FortiClient EMS CVE-2026-35616
- Fortinet confirms in-the-wild exploitation of CVE-2026-35616 and releases emergency hotfixes for EMS 7.4.5 and 7.4.6
- Ghost C2 staging and activity begins (mid-July 2026) on infrastructure later exposed
- SOCRadar discovers exposed open directories across seven servers holding Phantom, OpenCode history, knowledge bases and encryptors (late September 2026)
- Live encryption screenshot captured and three victim-specific encryptor packages prepared for deployment
- Planned deployment wave; operator chat references deploying 'tomorrow at 6 Moscow time'
- SOCRadar checks the operators' OpenRouter accounts, one nearly exhausted after more than $23,920 in spend
- GBHackers publishes summary of SOCRadar findings: 8,257 AI messages, 46 INC encryptor builds, 62 victim organizations
Sources cited for INC Ransomware Operators Use Claude AI and Phantom
- INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds (GBHackers)
- SOCRadar: INC and The Gentlemen Ransomware Exposed AI Infrastructure
- FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) - Help Net Security
- Fortinet Patches Actively Exploited FortiClient EMS Flaw - The Hacker News
- Fortinet FortiClientEMS Vulnerability Exploited in the Wild (CVE-2026-35616) - Qualys ThreatPROTECT
- cPanel zero-day exploited for months before patch release (CVE-2026-41940) - Help Net Security
- Arctic Wolf Security Bulletin: CVE-2026-41940
- CISA Advisory AA25-163A: SimpleHelp RMM exploitation by ransomware actors
- Critical SimpleHelp Vulnerability (CVE-2024-57727) Exploited by Ransomware Groups - Hive Systems
Detection coverage for TL-2026-4020
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4020 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4020
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.