An exposed AI ransomware operation has revealed how criminal affiliates used commercial models to help plan intrusions and extortion. The disclosure provides an unusually detailed view of the infrastructure, tools and decision-making behind recent ransomware activity.
SOCRadar made the investigation public on 20 October 2026. Its findings connect the exposed systems with affiliates associated with INC Ransomware and The Gentlemen Ransomware, although the evidence does not suggest that artificial intelligence operated without human direction.
AI ransomware infrastructure discovered in September
SOCRadar’s Threat Research Unit discovered the first publicly accessible attacker server through open directories in late September 2026. The server exposed AI session databases, a persistent knowledge base and source code for Phantom, described as an Autonomous Red Team Kill Chain Framework.
Credentials, configuration files and operational logs recovered from that host allowed researchers to identify six more exposed servers. Across the wider AI ransomware environment, they found victim tracking information, stolen credentials, malware, source code, attack notes and proposed extortion material.
The exposed knowledge base appears to have acted as the operation’s shared memory. It recorded campaign progress, potential targets, access details and information gathered from compromised systems. The same feature that helped operators maintain continuity also created a central repository of evidence when the server was left accessible.
Researchers identified 62 named organisations in the records, with industrial, manufacturing and healthcare organisations particularly visible. However, inclusion did not necessarily mean that an organisation had been encrypted. Some entries related only to reconnaissance, while others indicated deeper access, data theft or extortion activity.
How AI ransomware operators used commercial models
The researchers reviewed 8,257 messages across 133 AI sessions. OpenCode served as the operator interface, while OpenRouter provided access to commercial models identified in the records as Anthropic’s Claude Opus 4.6 and Moonshot AI’s Kimi K3.
The sessions showed AI ransomware operators using models across several stages of an attack:
- Planning reconnaissance and assessing possible targets.
- Selecting techniques and generating commands.
- Troubleshooting offensive tools and access problems.
- Reviewing stolen data to identify valuable information.
- Coordinating living-off-the-land activity on compromised systems.
- Drafting extortion messages and other victim communications.
Human operators remained responsible for decisions. Instructions commonly told the AI to coordinate tasks and wait for approval, making the system a human-directed assistant rather than an autonomous attacker.
When a model rejected a request, operators sometimes reframed the activity as an authorised red-team exercise. The records also contained a persona prompt labelled WormGPT. SOCRadar assessed this as a prompt label and integration pattern, not evidence that the criminals had accessed a separate uncensored model.
Account records indicated AI expenditure exceeding $23,920. This suggests sustained operational use rather than occasional experimentation, but it does not establish that Claude alone performed the reported work. Multiple models, interfaces and human operators were involved.
INC encryptors and victim activity exposed
The AI ransomware investigation recovered 46 custom INC encryptor builds prepared for six victims. Packaging records indicated that these builds were staged for planned deployment on 1 October 2026.
SOCRadar also referenced a screenshot dated 30 September 2026 that appeared to show live encryption on a victim workstation. Researchers therefore found evidence that encryption executed on at least one system, rather than the environment containing only planning material.
Recovered tooling reportedly included the Phantom framework, Ghost command and control software, RevSocks tunnelling capabilities and a Quick Heal or Seqrite bring-your-own-vulnerable-driver killer. Such a driver-based tool may be used to interfere with security software before encryption or data theft.
Atos Threat Research Center separately observed a misconfigured attacker HTTP service containing operational logs, tooling, OpenCode and the Phantom platform. Atos contacted identifiable victims and found that some organisations in the exposed records later overlapped with INC leak-site listings. This corroborates the infrastructure and AI-assisted workflow, although Atos did not reproduce SOCRadar’s precise message or encryptor counts.
Edge vulnerabilities cited in the attack records
The exposed AI ransomware notes placed significant emphasis on internet-facing management and remote-access products. Operators cited FortiClient EMS, SimpleHelp, and cPanel and WHM vulnerabilities as routes into target environments.
FortiClient EMS CVE-2026-35616
CVE-2026-35616 affects FortiClient EMS versions 7.4.5 through 7.4.6. The improper access control vulnerability can allow an unauthenticated attacker to execute code or commands through crafted requests.
Fortinet patched the issue on 5 April 2026 and reported exploitation in the wild. Its appearance in the exposed records is consistent with the operators’ focus on vulnerable systems that can provide remote access to an organisation’s network.
cPanel and WHM CVE-2026-41940
CVE-2026-41940 is an authentication bypass affecting cPanel and WHM versions after 11.40. cPanel released fixes on 28 April 2026, and active exploitation by multiple actors was subsequently reported. Public proof-of-concept code is also available.
Compromising a hosting management platform can expose websites, credentials and hosted customer environments. The operators claimed numerous cPanel breaches, but SOCRadar could not independently verify the scale recorded in the adversaries’ logs.
SimpleHelp CVE-2024-57727
CVE-2024-57727 affects SimpleHelp Remote Support 5.5.7 and earlier. It permits unauthenticated file downloads, potentially exposing server configuration data and stored secrets that can support further access.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 13 February 2025. The vendor advises upgrading to SimpleHelp 5.5.8 or later and rotating stored credentials. An operator claim involving 242 affected SimpleHelp IP addresses remains unverified and should not be treated as a confirmed victim total.
Current exploitation status and significance
As of 21 October 2026, no newer primary findings have superseded SOCRadar’s report. The three edge vulnerabilities cited in the records have independently documented exploitation, while this specific investigation includes evidence of at least one encryption event and prepared encryptors for six victims.
The case shows how AI ransomware groups can use legitimate services to accelerate planning, command generation and data review. It also demonstrates a weakness for attackers: persistent AI histories and shared knowledge stores can preserve extensive operational evidence when infrastructure is misconfigured.
Actions organisations should take now
Organisations should prioritise the products specifically identified in this event rather than treating the disclosure as a reason for broad, unfocused change. Recommended actions include:
- Apply Fortinet’s fixes for affected FortiClient EMS installations and review them for suspicious unauthenticated requests.
- Update cPanel and WHM to vendor-fixed builds, then complete the vendor’s post-patch checks.
- Upgrade SimpleHelp to 5.5.8 or later, rotate stored credentials and investigate possible configuration file access.
- Review internet-facing management systems for unknown accounts, tunnelling tools, credential reuse and unexpected remote sessions.
- Where OpenRouter or similar gateways are authorised, retain proxy and API telemetry that can support investigation of unusual model identifiers or usage patterns.
No public list of infrastructure indicators, hashes or file paths for this AI ransomware investigation was available in the published summary. Defenders should therefore combine vendor guidance for the cited vulnerabilities with internal logs and evidence of abnormal remote-management activity.
Originally reported by cybersecuritynews.com.
