# INC Ransomware Operators Use Claude AI and Phantom Framework; Exposed Data Shows 8,257 Messages and 46 Victim-Specific Encryptor Builds (CVE-2026-35616, CVE-2024-57727, CVE-2026-41940)

> SOCRadar Threat Research Unit analyzed exposed infrastructure showing INC ransomware affiliates (with shared tooling linked to The Gentlemen group) using OpenCode with OpenRouter-hosted Claude Opus 4.6 and Kimi K3, plus a custom 'Phantom' kill-chain framework, for AI-assisted reconnaissance and command generation. Recovered data includes 8,257 AI messages across 133 sessions, 46 victim-specific INC encryptor builds and 62 named victim organizations, with initial access via FortiClient EMS, SimpleHelp and cPanel/WHM vulnerabilities.

- **Published:** 2026-10-21T06:59:00Z
- **Last reviewed:** 2026-10-21T06:59:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4020
- **ID:** TL-2026-4020
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** INC Ransomware affiliates
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616, CVE-2024-57727, CVE-2026-41940

## Description

In late September 2026 SOCRadar investigators found open directories on a cluster of seven servers (mostly AS267784, Flyservers S.A.) that exposed the working environment of a ransomware tooling operation. The environment held an OpenCode interface backed by OpenRouter-hosted models (Claude Opus 4.6 and Kimi K3), three iterations of persistent knowledge bases tracking victims, credentials and campaign progress, 32 WormGPT-labelled MCP servers, and 'Phantom', a self-described 'Modular Autonomous Red Team Kill Chain Framework' with 18 skill modules, an autopilot mode and Python/Go agents masquerading as Windows Update. Operators framed prompts as an 'Authorized Red Team Assessment' to get around model refusals; actions were reported to require human approval at each step. One OpenRouter account had spent more than $23,920; 8,257 messages across 133 sessions were recovered. The operators were assessed as Russian-speaking and active roughly 06:00-14:00 UTC.

Initial access relied on FOFA-driven scanning for exposed FortiClient EMS, SimpleHelp, mail and VPN hosts and exploitation of three vulnerabilities. CVE-2026-35616 is a FortiClient EMS pre-authentication API access-control bypass (affecting 7.4.5 and 7.4.6; exploitation first seen by watchTowr honeypots on 2026-03-31 and confirmed by Fortinet with hotfixes on 2026-04-04); the operators claimed 108 administrator accounts across 2,236 EMS targets. CVE-2024-57727 is an unauthenticated SimpleHelp path-traversal (CWE-22, SimpleHelp 5.5.7 and earlier, CISA KEV since 2025-02-13); the data shows 427 admin passwords harvested from 242 unique IPs. CVE-2026-41940 is a cPanel & WHM CRLF-injection authentication bypass (reportedly exploited since about late February 2026 before the patch); 49+ cPanel breaches were claimed. Spearphishing with malicious .dotm template injection, LNK-in-ZIP and HTML smuggling, plus vishing scripts, were also prepared. Failed or attempted exploits included ZeroLogon (CVE-2020-1472, used against two domain controllers), PrintNightmare (CVE-2021-1675, failed), Roundcube CVE-2025-49113, PAN-OS User-ID overflow and a FortiGate SAML bypass.

Post-exploitation used Ghost C2 (three polymorphic implant generations communicating over HTTPS via Cloudflare, Telegram and DNS; staging since mid-July 2026), the QuickLine Cloudflare-fronted Mythic/Athena agent, RevSocks reverse SOCKS5 tunnels alongside Chisel and Ligolo-ng, MeshCentral agents, NetExec for SMB admin-share movement, RDP, and credential reuse (one password unlocked VPN, servers, RMM and backup platform). Persistence included a scheduled task named RealtekAudioSvc running svc.py. A Quick Heal/Seqrite security killer abused a vulnerable Zemana driver (BYOVD), with mixed results against enterprise EDR. Data was exfiltrated with restic, rclone, rks3 and BackupAgent to cloud object storage.

The 46 victim-specific INC encryptors (Rust-based, Windows and Linux) append the .INC extension, drop INC-README.txt pointing to a Tor chat portal, stop backup and database services, delete shadow copies through direct driver calls (IOCTL 0x53C028) rather than vssadmin, and offer a quiet mode that restores last-write timestamps. Three encryptor packages were prepared on 2026-09-30 for a deployment planned for 2026-10-01. Of 62 named organizations (36 in the US), 4 were publicly extorted, 4 were at the encryption/extortion stage, 14 had domain compromise, 28 a foothold and 12 reconnaissance only; industrial/manufacturing (16.1%) and healthcare/pharma (14.5%) led the sector mix. SOCRadar rates a formal INC/Gentlemen alliance at low confidence but a shared operational environment at moderate-to-high confidence, assessing the operator as a dedicated tooling and infrastructure provider serving multiple ransomware partners. Claimed victim counts are unverified operator data. CVSS for the campaign is not stated; component CVEs: CVE-2026-35616 CVSS 9.1, CVE-2026-41940 CVSS 9.8, CVE-2024-57727 CVSS 7.5. The GBHackers report is a secondary summary of the SOCRadar publication.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1591 Gather Victim Org Information
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1566.001 Spearphishing Attachment
- T1053.005 Scheduled Task
- T1036 Masquerading
- T1027.006 HTML Smuggling
- T1685 Disable or Modify Tools
- T1221 Template Injection
- T1070.006 Timestomp
- T1003.006 DCSync
- T1003.003 NTDS
- T1558.003 Kerberoasting
- T1555.003 Credentials from Web Browsers
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1572 Protocol Tunneling
- T1090 Proxy
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds (GBHackers)](https://gbhackers.com/inc-ransomware-attack-2/)
- [SOCRadar: INC and The Gentlemen Ransomware Exposed AI Infrastructure](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/)
- [FortiClient EMS zero-day exploited, emergency hotfixes available (CVE-2026-35616) - Help Net Security](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/)
- [Fortinet Patches Actively Exploited FortiClient EMS Flaw - The Hacker News](https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html)
- [Fortinet FortiClientEMS Vulnerability Exploited in the Wild (CVE-2026-35616) - Qualys ThreatPROTECT](https://threatprotect.qualys.com/2026/04/06/fortinet-forticlientems-vulnerability-exploited-in-the-wild-cve-2026-35616/)
- [cPanel zero-day exploited for months before patch release (CVE-2026-41940) - Help Net Security](https://helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/)
- [Arctic Wolf Security Bulletin: CVE-2026-41940](https://arcticwolf.com/resources/blog/cve-2026-41940)
- [CISA Advisory AA25-163A: SimpleHelp RMM exploitation by ransomware actors](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a)
- [Critical SimpleHelp Vulnerability (CVE-2024-57727) Exploited by Ransomware Groups - Hive Systems](https://www.hivesystems.com/blog/critical-simplehelp-vulnerability-cve-2024-57727-exploited-by-ransomware-groups)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4020