Press play to start listening
SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen credentials and 46 encryptor builds.
Cybersecurity researchers at SOCRadar recently discovered seven exposed servers linked to INC Ransomware and The Gentlemen ransomware affiliates, finding AI session logs, stolen credentials and ransomware tools among the exposed data.
According to the company’s report, published on October 20, the SOCRadar Threat Research Unit (STRU) recovered 8,257 AI messages across 133 OpenCode sessions, along with 46 custom INC encryptor builds prepared for six victims.
The records also indicated more than $23,920 in AI API spending, and the use of commercial models by the operators, including Claude Opus 4.6 and Kimi K3.
AI-Assisted Intrusions Remained Under Human Control
The operators used OpenCode, an AI coding interface, alongside persistent knowledge bases to plan reconnaissance, generate commands, analyze stolen credentials and draft reports.
The session logs show that human approval was required before each step. One instruction told the AI to “coordinate every action with me,” indicating that the operators retained control over the attack process.
When commercial models refused malicious requests, the operators rephrased their prompts as “Authorized Red Team Assessment Request” templates. This suggests they tried to get around the models’ refusals through prompt changes rather than switching to different models.
Exploited Vulnerabilities and Custom Tools
According to operator records analyzed by STRU in its report, the affiliates targeted internet-facing systems and remote-access infrastructure, including:
- CVE-2026-41940 (cPanel): Operators claimed more than 49 breaches of hosting providers.
- CVE-2024-57727 (SimpleHelp): Scans of 4,922 servers reportedly yielded 427 administrator passwords, with 242 unique IP addresses listed as impacted.
- CVE-2026-35616 (FortiClient EMS): Records claimed 2,236 targets, 108 newly created administrator accounts and 4,140 managed endpoints.
These figures come from the attackers’ records and have not been independently verified. The exposed servers also contained WormGPT-labelled MCP server, Phantom, a custom framework for coordinating attack activities, alongside command-and-control tools and software designed to disable security products.
Ransomware Builds and Victim Records
The investigation identified 62 named organizations in the operators’ records, including 36 in the United States. Industrial and manufacturing organizations accounted for 16.1% of the listed targets, followed by healthcare and pharmaceutical organizations at 14.5%.
Although 46 INC encryptor builds were prepared for six victims ahead of a planned October 1, 2026, deployment, the report does not confirm that all six attacks took place. A September 30 screenshot from a SimpleHelp console showed an encryptor running on a victim workstation, providing evidence of encryption activity in at least one case.
The records also described an extortion strategy built around stolen financial and business data, with threats to contact victims’ customers, partners and regulators. The findings offer a rare look at how ransomware operators used AI during active intrusions while retaining human oversight.
