People have been predicting AI-driven ransomware for a couple of years, mostly in conference talks and vendor slides. Now there is a look at what it actually involves, and it comes from the attackers' own servers. Threat intelligence firm SOCRadar says it analyzed seven exposed servers belonging to affiliates operating with the INC and The Gentlemen ransomware brands. According to the firm, the operators handed much of the hands-on intrusion work to AI coding agents and kept a human in the loop to approve what those agents did.

SOCRadar published its analysis on October 20 and updated it on October 23. The Hacker News also reported on it October 23 and described the operating structure as "AI-executed, human-approved." One caveat applies to everything below. These findings rest on researcher attribution and on the operators' own logs and records. They are not confirmations from victims. Where a number comes from what the attackers wrote down, this article says so.

What was on the servers

SOCRadar says the operators used OpenCode, an open-source AI coding agent, connected to commercial large language models hosted through OpenRouter, a service that resells access to many models through one API. The firm counted 8,257 messages across 133 sessions and reports recorded AI API spending of more than $23,920.

That spending is the first detail worth noticing. For roughly $24,000 in model fees, the affiliates ran thousands of messages' worth of machine-assisted reconnaissance, exploitation, and post-exploitation work. Neither source claims the AI made the operators more capable than a skilled human crew. What the logs suggest is that AI made the work cheaper to scale.

The Hacker News, summarizing SOCRadar's findings, lists the toolkit:

  • Phantom, an AI-driven attack framework with 18 "skill" modules. In agent frameworks, a skill is a packaged capability the agent can call on, such as reconnaissance or exploit research.
  • WormGPT-MCP, a set of 32 MCP servers. MCP, the Model Context Protocol, is a standard way to connect AI agents to outside tools and data. In this case, it connected the agent to modules ranging from reconnaissance to extortion.
  • Ghost C2, a command-and-control implant family for managing compromised machines.
  • RevSocks, a reverse SOCKS5 framework used to pivot inside victim networks and stage data for exfiltration.
  • A BYOVD killer, described as a Quick Heal/Seqrite EDR killer that abuses a Zemana driver. In a "bring your own vulnerable driver" attack, the attacker installs a legitimate but flawed signed driver and uses it to shut down security software from kernel level.

How the "human-approved" part worked

Commercial AI models are trained to refuse requests that look like hacking. The logs show how the operators got around that. According to The Hacker News, when a model refused a prompt, the operator rewrote the request as an authorized red-team assessment instead of switching models.

Per the reporting, a human operator supplied a victim-specific prompt and reviewed every step, while OpenCode and the hosted models executed the intrusion. That division of labor matters to defenders. The tempo of an intrusion may now depend on how fast an operator approves steps, not how fast an operator types.

The way in: three known, catalogued flaws

SOCRadar says the operators' records show mass exploitation of internet-facing edge and remote-access systems. Three of the flaws it lists as actively exploited were already in CISA's Known Exploited Vulnerabilities (KEV) catalog before the activity SOCRadar describes, which ran from mid-July to late September 2026. SOCRadar also lists other flaws as attempted, staged or developed, which this article does not cover.

  • Fortinet FortiClient EMS, CVE-2026-35616. The operators' records list 2,236 targets and 108 administrator accounts created. According to the NVD entry, it is an improper access control flaw in FortiClientEMS 7.4.5 through 7.4.6 that may let an unauthenticated attacker execute unauthorized code or commands through crafted requests. It is rated CVSS 3.1 9.8, Critical. NVD published it April 4, 2026. CISA added it to KEV on April 6 with a federal remediation deadline of April 9.
  • SimpleHelp, CVE-2024-57727. The records list 242 unique IP addresses impacted. This is a path traversal flaw in the SimpleHelp remote support software. CISA added it to KEV on February 13, 2025, and marks its use in ransomware campaigns as "Known."
  • WebPros cPanel & WHM, CVE-2026-41940. The operators claim 49 or more breaches of small hosting providers. CISA added it to KEV on April 30, 2026, with a due date of May 3, and also marks ransomware use as "Known."

The counts of targets, admin accounts, IP addresses and breaches above come from the attackers' own records, as reported by SOCRadar. They have not been independently verified, and a "target" in an attacker's log is not necessarily a confirmed compromise.

Reused passwords were the main multiplier

If you take one thing from the report, take this: SOCRadar's own conclusion is that credential reuse, not the AI, was the main force multiplier. In one case, per the operators' records, a single reused password unlocked the victim's VPN, servers, remote monitoring and management (RMM) platform, backup system and security management platforms at once.

That combination is about as bad as it gets for a ransomware victim. The VPN provides access. RMM lets the attacker push software to every managed machine. The backup console lets them destroy the means of recovery before the encryptor runs. Automated tooling that tries harvested passwords against every login it can reach would make this kind of reuse cheap to find, though the sources do not quantify that.

The results were not uniformly good for the attackers. The Hacker News notes that the operators' own logs record mixed results against enterprise endpoint detection and response (EDR) products, which is presumably why a BYOVD driver killer was in the kit at all.

Staged encryptors and claimed victims

SOCRadar says the servers held 46 INC encryptor builds for six victims, packed for an October 1 deployment. It also cites a September 30 SimpleHelp screenshot showing live encryption on a victim, though it says deployment against the staged targets is unconfirmed. In other words, the material captured an operation that was still moving, not one reconstructed long after the fact.

The operator material names 62 organizations, 36 of them in the United States. By SOCRadar's breakdown, industrial, manufacturing and energy organizations lead at 16.1%, followed by healthcare and pharmaceutical organizations at 14.5%. The Hacker News adds that four of the 62 ended up on the INC and The Gentlemen leak sites, and that the outcome of the ransom demands is unknown because no cryptocurrency wallet or payment record was recovered. These are unverified claims drawn from attacker records, and ZeroDayFeed is not naming the organizations.

Who is behind it

SOCRadar assesses that the operators are Russian-speaking and most active between 06:00 and 14:00 UTC. That is SOCRadar's attribution, based on its analysis of the infrastructure and logs. The sources make no claim of state sponsorship. The actors are described as affiliates operating with the INC and The Gentlemen ransomware brands, and SOCRadar says the most plausible structure is a dedicated tooling and infrastructure provider supporting several ransomware partners.

What It Means for Defenders

The AI angle makes the headline, but the defensive work is familiar. The three confirmed entry points described here were known, catalogued vulnerabilities on internet-facing systems, and SOCRadar singles out credential reuse as the biggest multiplier. If AI agents shorten the gap between "exposed" and "exploited," as seems plausible, the following matters more than it did before.

  • Find and fix FortiClient EMS. If you run FortiClientEMS, check whether you are on an affected 7.4.5 or 7.4.6 build and apply Fortinet's fix for CVE-2026-35616. Don't wait for a maintenance window. Afterward, audit EMS for administrator accounts you did not create. The operators' records claim 108 of them were added. Patching does not remove an account that was planted before the patch.
  • Patch or retire SimpleHelp. CVE-2024-57727 has been in KEV since February 2025, and CISA lists it as used by ransomware. Any SimpleHelp server still unpatched and reachable from the internet should be treated as possibly compromised. Update it, review its sessions and technician accounts, and consider putting it behind a VPN or zero-trust gateway.
  • Patch cPanel & WHM. Hosting providers and small businesses running their own cPanel servers should confirm they are patched for CVE-2026-41940, which is also flagged in KEV for ransomware use.
  • Kill password reuse across tiers. VPN, server admin, RMM, and backup consoles should each have unique credentials and phishing-resistant MFA. If any of those systems were exposed to the flaws above, rotate their credentials now. The one-password-opens-everything scenario in this report is preventable.
  • Isolate backups. Your backup console should not be reachable with the same identity used for day-to-day administration. Keep at least one immutable or offline copy.
  • Block vulnerable drivers. BYOVD attacks depend on loading old signed drivers. Turn on your OS or EDR vendor's vulnerable-driver blocklist, and alert when an EDR agent stops reporting, which can be an early sign of a driver killer.
  • Use KEV as your patch priority list. All three CVEs here were in KEV months before this activity. KEV is a free, short list of what attackers are actually using.
  • Watch your own AI tooling. If your organization runs AI agents with MCP connections, inventory them and restrict what they can reach. The attackers' setup is a reminder that an agent with tool access is effectively a privileged user.

The sources do not suggest the AI gave these affiliates abilities a competent human crew lacked. What it gave them was scale, with thousands of targets across the operators' records for about $24,000 in recorded model spend. Defenders can't win on volume. What they can do is close the doors those agents keep trying.

Sources