On October 23, 2026, The Hacker News reported that SOCRadar researchers had discovered exposed infrastructure belonging to affiliates of the INC and The Gentlemen ransomware groups1. According to the researchers' assessment, a Russian-speaking operator used a framework called Phantom: a human supplied a victim-specific prompt and reviewed every step, while intrusions were executed through OpenCode with commercial models hosted on OpenRouter1. When models refused, requests were rewritten as an "authorized red team assessment"1. According to SOCRadar and operator records, initial access came through flaws in FortiClient EMS, SimpleHelp, cPanel and VPN gateways1. SOCRadar called credential reuse the main force multiplier: in one case, a single reused password unlocked the VPN, servers, RMM, backups and security management platforms1. An estimated 62 organizations were targeted, four of which appeared on leak sites1. Ransom outcomes are unknown, as no wallets or payment records were recovered1. Our conclusion, not the source's: patch edge systems promptly and eliminate password reuse.

  1. [1] Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute IntrusionsThe Hacker News