Actor Profile

INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners across the ransomware ecosystem. They employ an "AI-executed, human-approved operating structure" where human operators provide victim-specific prompts and review each step, while AI agents execute intrusions through OpenCode with OpenRouter-hosted commercial models. The operation demonstrates sophisticated credential reuse tactics and a data-centric extortion approach that analyzes stolen financials to determine ransom amounts victims can pay without involving banks or insurers.

TTPs (Tactics, Techniques, Procedures)

Initial access achieved through mass exploitation of public-facing edge devices including FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), cPanel/WHM (CVE-2026-41940), and VPN gateways. Post-compromise activities include domain enumeration, privilege escalation to domain admin, credential harvesting via stealer tooling, and targeted data collection focused on finance, HR, legal, and executive files. Lateral movement facilitated through credential reuse and reverse-SOCKS tunnels (RevSocks). Defense evasion accomplished via BYOVD attacks using Zemana driver (zam64.sys) to disable EDR solutions. Data exfiltration conducted through tools like rks3 and BackupAgent. The operation employs polymorphic C2 implants (Ghost C2) communicating over Cloudflare, Telegram, or DNS. AI framework (Phantom) supports 18 skill modules for reconnaissance, exploit research, EDR fingerprinting, and binary reverse engineering. Extortion tactics include vishing calls, threats to notify stakeholders and regulators, and publication on data leak sites within 24-72 hour deadlines.

Targets & Patterns

The operation targeted 62 organizations, with the United States accounting for over 50% of victims. Primary targeting focused on industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations. Target selection appears driven by exploitation opportunities in exposed internet services rather than sector-specific strategic objectives. The actors specifically sought organizations with vulnerable FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls. Post-intrusion, attackers prioritized high-value data repositories containing financial, HR, legal, and executive information. The data-centric extortion model suggests targeting organizations with sufficient financial capacity to pay ransoms without external involvement. Four victims were ultimately listed on INC and The Gentlemen data leak sites, though final ransom payment outcomes remain unknown.

Historical Context

This campaign represents an evolution in ransomware affiliate operations through integration of AI-driven automation frameworks. The exposed infrastructure at 45.227.254[.]43 logged 8,257 messages across 133 sessions, providing unprecedented visibility into AI-assisted intrusion workflows. The operation's use of three generations of polymorphic Ghost C2 implants indicates iterative development over time. The actors' deployment of WormGPT-MCP with 32 Model Context Protocol servers demonstrates adaptation of emerging AI technologies for offensive operations. When commercial AI models refuse malicious prompts, operators reframe requests as authorized red team assessments rather than switching models, showing operational maturity and OPSEC awareness. The campaign's infrastructure provider role suggests these affiliates occupy a mid-tier position in the ransomware ecosystem, supporting multiple partner groups beyond INC and The Gentlemen.

Defensive Recommendations

  • Prioritize patching CVE-2026-35616 (Fortinet FortiClient), CVE-2024-57727 (SimpleHelp), and CVE-2026-41940 (cPanel/WHM) which are actively exploited for initial access
  • Implement network segmentation and enforce unique credentials across VPN, RMM, backup, and security management platforms to prevent credential reuse attacks
  • Deploy driver signature enforcement and monitor for BYOVD attacks targeting EDR solutions, specifically watching for abuse of legitimate drivers like zam64.sys (Zemana)
  • Monitor for reverse-SOCKS proxy establishment (RevSocks) and anomalous outbound connections to Cloudflare Workers, Telegram APIs, and DNS tunneling patterns associated with Ghost C2
  • Establish behavioral detection for mass enumeration of finance, HR, legal, and executive file shares, and implement DLP controls with alerting on bulk data staging and exfiltration attempts

---

# Geopolitical Context

Geopolitical Context

The discovery of the Phantom framework represents a tactical evolution in the ransomware-as-a-service (RaaS) ecosystem, where affiliates linked to INC and The Gentlemen groups have integrated commercial AI models into operational workflows. The Russian-speaking operators function as both intrusion specialists and infrastructure providers, demonstrating the continued maturation of Eastern European cybercrime networks. The campaign's targeting profile—over 50% U.S. victims, with concentration in industrial, manufacturing, energy, and healthcare sectors—is consistent with financially motivated cybercrime that opportunistically affects critical infrastructure. The use of AI to scale exploitation of edge devices (FortiClient EMS, SimpleHelp, cPanel, VPN gateways) and automate post-compromise activities reflects broader trends in adversary tooling sophistication. While the operators employ Russian language and infrastructure, attribution to state direction remains unestablished; the data-centric extortion model and focus on payment extraction align with profit-driven criminal enterprise rather than espionage or strategic disruption.

State Actor Alignment

The threat actors are assessed to be Russian-speaking and operate within the established RaaS affiliate model associated with INC and The Gentlemen ransomware families. No direct linkage to Russian state intelligence services is evident in available reporting. However, the operational environment—Russian-language communications, targeting of Western entities, and apparent safe harbor—is consistent with the permissive ecosystem that has historically enabled cybercriminal groups to operate from Russian and Commonwealth of Independent States (CIS) jurisdictions with limited law enforcement interference. The campaign's financial motivation and data-extortion methodology suggest independent criminal actors rather than state-sponsored operations, though the line between tolerated cybercrime and state interest remains strategically ambiguous in the Russian context. U.S. and allied sanctions frameworks targeting ransomware infrastructure and cryptocurrency flows may apply, though specific designations related to this operation have not been reported.

Business Impacty pro region

The campaign's geographic distribution—with the United States representing over half of the 62 targeted organizations—underscores continued exposure of North American enterprise and critical infrastructure to Eastern European cybercrime. The targeting of industrial, manufacturing, energy, and healthcare sectors raises operational resilience concerns, particularly where credential reuse and edge device vulnerabilities enable rapid lateral movement and domain compromise. For European allies, the exploitation of widely deployed remote access and management platforms (Fortinet, SonicWall, Ivanti, SimpleHelp) signals shared risk across transatlantic supply chains and managed service ecosystems. The use of commercial AI platforms (OpenRouter-hosted models) to automate intrusion workflows may complicate attribution and detection, as malicious activity is mediated through legitimate cloud services. The campaign also highlights regulatory and incident response challenges: the operators' extortion methodology explicitly calculates ransom demands to avoid triggering insurance or banking notifications, exploiting gaps in mandatory breach disclosure thresholds. For NATO and EU member states, the incident reinforces the need for coordinated vulnerability disclosure, edge device hardening, and intelligence sharing on RaaS affiliate infrastructure.

Forecast

If commercial AI model providers do not implement robust abuse detection and usage policy enforcement, adversary adoption of AI-assisted intrusion frameworks is likely to accelerate, lowering technical barriers for affiliate operators and increasing campaign velocity. If organizations fail to address credential reuse and edge device patching—particularly for the actively exploited CVE-2024-57727, CVE-2026-35616, and CVE-2026-41940 vulnerabilities—the operational model demonstrated by Phantom may be replicated by additional RaaS affiliates, expanding the threat surface. If law enforcement and intelligence agencies successfully disrupt the exposed infrastructure (45.227.254[.]43) and associated command-and-control nodes, short-term operational degradation for INC and The Gentlemen affiliates is probable, though reconstitution under new infrastructure is historically common within the RaaS ecosystem. If regulatory pressure on AI service providers and cryptocurrency exchanges intensifies, ransomware operators may shift toward more decentralized or obfuscated payment and tooling channels, complicating interdiction efforts. Over the next six to twelve months, continued targeting of U.S. and allied critical infrastructure by Russian-speaking cybercriminal groups appears likely, absent significant shifts in the permissive operating environment or coordinated international enforcement action.