SOCRadar found an open directory from a Russian-speaking affiliate of the INC and The Gentlemen ransomware operations revealing Phantom, an 18-module AI offensive framework, and WormGPT-MCP, 32 Model Context Protocol servers wiring commercial models (via OpenCode and OpenRouter) to recon, exploitation and extortion tools. Logs show 8,257 messages across 133 sessions and about 62 targets, mostly US industrial, energy and healthcare firms; humans wrote prompts and approved steps while the AI executed.
What to do: Operator infrastructure exposed; campaigns continue; models were jailbroken by reframing as red teaming. Oct 24: SOCRadar found exposed infrastructure used by INC and Gentlemen affiliates: 8,257 messages and 133 AI agent sessions used to exploit Fortinet, SimpleHelp and cPanel flaws at 62 organizations.
AI angle: Concrete evidence of ransomware crews using MCP servers to let AI agents run commands end to end.
🚨 EXPOSED SERVERS REVEAL AN AI-ASSISTED RANSOMWARE WORKBENCH TIED TO INC AND THE GENTLEMEN A threat research report published Oct 20, 2026 describes seven exposed adversary servers used by affiliates of the INC and The
🚨 Exposed infrastructure reveals how ransomware affiliates used AI to hack networks and steal data. 8,257 messages. 133 AI sessions. 62 organizations targeted. Operators exploited Fortinet, SimpleHelp, and cPanel flaws. Inside the operation ↓
Why this score
Dozens of organizations (impact 2), live intrusions with four victims already on leak sites (exploitability 3), energy and healthcare touched (criticality 1).