Security Alert | INC/Gentlemen Ransomware Expose a Complete AI Co-Operator Record — 8,257 Messages, 32 MCP Servers, 62 Victim Organizations

🌏 中文版

Incident Overview

Threat intelligence firm SOCRadar's Threat Research Unit (STRU) published a report on October 20, 2026 describing how it traced a single exposed command-and-control server with an open directory (45.227.254[.]43) to six more servers, fully reconstructing how a shared operator behind INC Ransomware and The Gentlemen Ransomware ran AI through the entire intrusion lifecycle. The exposed material included 8,257 AI chat messages across 133 OpenCode sessions, the source and binaries for a self-built "autonomous red-team kill chain framework" called Phantom, a toolkit wired to 32 MCP servers, 46 INC encryptor builds already customized and packaged for six victims, and complete case files for 62 victim organizations. This is the most detailed public reconstruction yet of how AI agents are actually operated inside a real ransomware campaign — and the evidence goes well beyond a single anecdote, because the operators' own AI session memory became the forensic trail that let defenders rebuild the whole attack chain.

Key Facts

Attack Surface Analysis

The exposed operation breaks down into three layers worth looking at separately.

Layer one is the entry point. The operators used no novel technique at all — just known edge-device CVEs exploited at scale. Their own knowledge base records show they scanned 2,236 targets, created 108 admin accounts, and touched 4,140 managed endpoints through FortiClient EMS (CVE-2026-35616); scanned 4,922 SimpleHelp servers and extracted 427 admin passwords across 242 distinct IPs (CVE-2024-57727); and claimed to breach 49-plus small hosting providers through cPanel/WHM (CVE-2026-41940), using those providers as a springboard into the mail and web servers they host. These numbers come from the attackers' own records — SOCRadar explicitly flags them as "not independently verified" — but the scale alone makes the point: edge devices remain the cheapest way in.

Layer two is how AI got wired into the whole chain. The operators used OpenCode, an AI coding interface, as their operations console, connected to commercial models hosted on OpenRouter (Claude Opus 4.6, Kimi K3 — nothing underground), plus a homebrew "WormGPT" persona prompt and a persistent knowledge base. What actually turned the AI into something that could act was Phantom — a modular framework with 18 skill modules, its own routing engine, and an autopilot orchestrator — which used 32 MCP servers to wire the AI into every tool from reconnaissance to ransom negotiation, including a dedicated "ransom-ops" server for pricing and negotiation. The report uses the term "exec_in_session" to describe this operational abuse of an MCP tool-execution surface: the AI wasn't sitting on the sidelines offering advice — it was directly calling through MCP to run reconnaissance commands, triage stolen credentials, and draft extortion letters.

Layer three is why a human stayed in the loop. The 8,257 messages show that every case opened with a victim-specific master prompt, and the AI waited for operator approval before every step; one instruction spelled it out: "coordinate every action with me." More tellingly, when a commercial model refused a request, the operator's response wasn't to switch to an uncensored model — it was to rewrite the request as an "Authorized Red Team Assessment Request" template, talking its way past the safety guardrail rather than bypassing the model itself. That means "WormGPT" was just marketing dressed over a persona prompt; what ran underneath was an ordinary commercial LLM the whole time — the chokepoint for guardrail bypass was never on the model provider's side, it was in how the application layer packaged the request.

Mapped to the OWASP LLM Top 10, this is a textbook case of LLM06: Excessive Agency: wiring 32 MCP servers into an AI goes far beyond what "writing code" requires — direct command execution, operating penetration tools, drafting extortion documents — and "a human approves every step" flips from a safety control into a liability shield in a criminal context: the operator knew exactly what they were doing, and the AI just automated the reconnaissance, triage, and drafting work that used to take the most human hours, at a much faster pace. This also echoes CloudSEK's early-October disclosure of a separate Gentlemen affiliate, Azazel, who registered a reverse shell as an MCP tool inside an AI coding assistant to drive attacks directly. Both incidents point at the same pattern: once an MCP tool-execution surface is wired to a tool with real system access, the security boundary is no longer the model's conversational guardrail — it's who can register a tool, and what that tool can do.

Defense

Immediate actions

• Audit any internet-facing FortiClient EMS, SimpleHelp, or cPanel/WHM management interface: confirm patches for CVE-2026-35616, CVE-2024-57727, and CVE-2026-41940 are applied, remove direct network exposure of management interfaces, and check EMS for unknown admin accounts or tampered VPN connection scripts
• Inventory which AI coding assistants inside your organization (OpenCode, Claude Code, Cursor, etc.) have MCP servers configured, and verify the actual permission scope of every MCP tool one by one — any tool that can run shell commands, open a reverse connection, or access credentials should never be wired up without access control and audit logging
• If any MSP/RMM platform (SimpleHelp, MeshCentral, N-central, etc.) serves external customers, enforce MFA and IP allowlisting, and require upstream MSPs to apply the same controls — in this incident, a stolen MSP technician credential was equivalent to unlocking every client that technician managed
• Make backups immutable or air-gapped, and isolate and patch backup consoles like Veeam — the records show the operators routinely stopped backup and database services and deleted shadow copies before encrypting

Long-term architecture

• Treat "who can register an MCP tool inside the enterprise, and what can that tool do" as a formal governance question, not something left to individual dev teams to decide on their own; the watchlist's Netzilo, which focuses on cross-platform agent runtime governance including a kill switch, is built around exactly this: unapproved MCP servers simply can't get wired in
• Add behavioral monitoring for internal AI agent usage patterns; the watchlist's Zenity, which focuses on enterprise agent behavior monitoring, is aimed at exactly this gap — catching anomalous tool-call patterns (a burst of scan-style commands, a reverse-shell tool getting registered) outside normal development use
• The biggest irony here is that the operators' own AI memory became the evidence trail against them. Defenders can flip that same property around: keeping complete, centrally-audited tool-call logs on a legitimate agent platform means that if an internal account is hijacked to run an agent, anomalous MCP call patterns will surface faster than traditional endpoint logs would catch it

Impact

SOCRadar's grading shows that among the 62 named organizations, 4 reached public extortion (L5), 4 reached encryption or extortion stage (L4), 14 suffered domain-level compromise (L3), 28 had only a foothold (L2), and 12 were still at the reconnaissance stage (L1). The 46 packaged INC encryptors map to six victims and were originally scheduled for deployment on October 1, 2026 — a chat log confirms the timing with "tomorrow at 6 Moscow time, right?" — and a September 30 SimpleHelp screenshot confirms at least one victim's workstation was actually encrypted, though the report doesn't confirm whether all six attempts landed. For any team already running AI coding assistants with MCP servers in day-to-day development, the lesson here isn't "AI can turn evil on its own" — it's that once MCP wires an AI into a tool with real destructive power, that tool behaves like any other privileged access: if it's compromised, the damage scales with the tool's permission scope, and enterprises are usually slower than attackers to realize just how far that scope reaches.

Takeaway

Previous reporting on "AI being used in ransomware" mostly stopped at single-episode incidents — like the lone affiliate CloudSEK exposed in early October registering a reverse shell through MCP. SOCRadar's 8,257 messages are the first time we get to see what "AI as co-operator" actually looks like in a real criminal operation — not an autonomous sci-fi intrusion, but a fairly conservative operating model: a human approves every step, and AI handles automating the reconnaissance, triage, and drafting work that used to eat the most human hours. What surprised me most is that "WormGPT" was just a persona prompt — the underlying models were all ordinary commercial LLMs the whole time. That means the moment a guardrail gets bypassed, the problem was never on the model vendor's side — it's how the application layer packages the request. That's a warning for any team wiring tool permissions into an agent: the guardrail isn't there to stop a "malicious model," it's there to stop a "maliciously packaged request" — and the latter can always be retried with different phrasing.

References

• INC and The Gentlemen Ransomware: Exposed AI Infrastructure - SOCRadar
• INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages - hackread.com
• Caught in 4K: The Gentlemen Files - CloudSEK
• MITRE ATT&CK G1032 (GOLD IONIC / INC Ransomware)
• SimpleHelp Path Traversal CVE-2024-57727 - NVD
• FortiClient EMS Vulnerability CVE-2026-35616 - NVD
• OWASP LLM Top 10 — LLM06: Excessive Agency