Executive Summary
SOCRadar's Threat Research Unit (STRU) identified an advanced, AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. The campaign, which surfaced in late September 2026, relies on a human-approved, AI-executed operational structure using commercial LLMs to plan reconnaissance, generate commands, and manage victim data. The operators' AI spending on OpenRouter accounts exceeded $23,000, illustrating a significant investment in automated offensive capabilities.
The attack chain typically begins with the exploitation of edge devices at scale, notably FortiClient EMS (CVE-2026-35616) and SimpleHelp (CVE-2024-57727), followed by lateral movement and credential harvesting. The investigation uncovered a custom arsenal including the 'Phantom' autonomous red team framework, which masquerades as Windows Update components, and multiple generations of 'Ghost C2'.
This threat poses a severe risk to industrial, manufacturing, and healthcare sectors, with 62 named organizations targeted primarily in the United States. The discovery of 46 staged INC encryptor builds and branded extortion packages for The Gentlemen victims indicates a highly coordinated operation capable of high-volume ransomware deployment.
Key Details
Threat Name
INC Ransomware
Affects
FortiClient EMS, SimpleHelp, cPanel, WHM, Windows Netlogon, PAN-OS, Windows Print Spooler, FortiGate, Windows LDAP, Veeam Backup Service, Windows Active Directory, SonicWall SMA1000, WordPress, Roundcube
Adversary
INC Ransomware Other Adversaries and Aliases: The Gentlemen Ransomware
MITRE Techniques
Malware/Tools
INC Ransomware, The Gentlemen Ransomware, Phantom, Ghost C2, RevSocks, QuickLine, Sliver, Athena