Exposed servers belonging to affiliates of the INC and The Gentlemen ransomware brands show commercial AI models being used to plan intrusions, triage stolen data and draft extortion material. Most of the figures come from the attackers’ own records, but the working pattern they describe should change how UK defenders think about the pace of ransomware.
What happened
On 20 October 2026 the SOCRadar Threat Research Unit published an analysis of seven adversary-controlled servers tied to affiliates of INC Ransomware and The Gentlemen. According to SOCRadar, the operators’ poor operational security left an open command-and-control server reachable from the internet, and files on it pointed researchers to six more machines. The exposure first surfaced in late September.
What the servers held is unusually revealing. SOCRadar reports 8,257 messages across 133 AI sessions, three versions of a persistent knowledge base, source code for an attack framework called Phantom, stolen credentials and campaign notes. It also found 46 INC encryptor builds, each personalised for one of six victims, with per-victim packages packed on 30 September for a deployment wave planned for 1 October. A screenshot dated 30 September appears to show encryption running on a victim workstation, although SOCRadar could not confirm that the full October wave went ahead.
The records name 62 organisations, 36 of them in the United States. Industrial, manufacturing and energy firms make up the largest share of targets at 16.1%, followed by healthcare and pharmaceutical organisations at 14.5%. Only four of the 62 appear publicly on leak sites. SOCRadar is careful to say that the access counts and victim tallies come from the operators’ own logs and have not been independently verified, and it rates a formal alliance between the two ransomware brands as low confidence. Its most likely explanation is a shared tooling provider serving several ransomware partners.
The technical picture
The striking detail is not that criminals used AI, which is now routine, but how the work was divided. The operators drove intrusions through OpenCode, an open-source coding agent, connected to commercial models hosted on OpenRouter. SOCRadar names Anthropic’s Claude Opus 4.6 and Moonshot’s Kimi K3 among them. Each campaign began with a master prompt specific to the victim. The model then planned reconnaissance, chose techniques, generated commands, sorted stolen data and wrote up reports, while a human operator signed off every step. One standing instruction, quoted by SOCRadar, told the model to “coordinate every action with me”.
Two points deserve attention. First, the “WormGPT” branding found on the servers was only a persona prompt sitting on top of mainstream models, not an uncensored criminal model. Second, when a model refused a request, the operators did not switch tools. They reworded the task as an authorised red team assessment and tried again. Recorded spending through OpenRouter exceeded $23,900, which is trivial against a single ransom.
The initial access routes are depressingly familiar. The operators’ records claim exploitation of FortiClient EMS (CVE-2026-35616), the SimpleHelp remote support tool (CVE-2024-57727), where stolen managed service provider technician credentials opened doors into downstream clients, and cPanel/WHM (CVE-2026-41940) at small hosting firms. The tooling recovered included Phantom with 18 skill modules, MCP servers labelled WormGPT-MCP, a command-and-control implant family, and a driver-based tool for killing Quick Heal and Seqrite security products.
This is a separate event from the exposed Cairn panels reported on this site on 20 October, which centred on autonomous AI agents. Here a human stayed firmly in the loop and the AI acted as a tireless operator’s assistant.
Why it matters for UK organisations
SOCRadar does not identify any UK victim in this dataset, and I would not read one into it. But INC Ransomware has hit UK public bodies and healthcare before, and the techniques here map directly onto the British estate I see on engagements: exposed management interfaces, remote support tools run by managed service providers, and Fortinet kit at the edge.
The MSP angle is the one that should worry UK boards most. Compromising a single SimpleHelp server with a reused technician password can hand an attacker every client that provider supports. That concentration of risk is why supplier access deserves the same scrutiny as your own perimeter.
The AI element changes the economics rather than the techniques. A small crew with a model doing the reading, scripting and data triage can run more campaigns in parallel and keep going through the night. The model never tires of sifting a stolen file share for financial documents to price a ransom demand.
Expert view
In my experience, the time between initial foothold and domain compromise is where most organisations either catch an intrusion or lose. Anything that compresses that window works against the defender, and an attacker with a model generating the next command in seconds compresses it considerably. What these logs show is that the human operator is becoming a supervisor rather than a typist.
The refusal workaround is the part AI providers will find uncomfortable. Recasting a malicious request as authorised testing is exactly the framing that genuine penetration testers use every day, which is why guardrails based on stated intent are so brittle. I do not expect model vendors to solve this alone, and nor should defenders wait for them to.
It is also worth keeping perspective. Nothing in the dataset shows a successful intrusion built on a novel exploit invented by AI. Every entry point the operators recorded as working is a known, patchable vulnerability or a weak credential. The model made a competent crew faster; it did not make an incompetent one dangerous. That is good news, because it means the controls that stop human-led ransomware still stop this.
What to do now
- Patch the edge first. Confirm FortiClient EMS, Fortinet and SonicWall appliances and cPanel/WHM are on fixed versions, and remove management interfaces from the internet. This is the Cyber Essentials security update management control, and the 14-day rule for high and critical fixes applies.
- Hunt for persistence on EMS. Look for unexpected administrator accounts and altered VPN scripts, which SOCRadar highlights as the operators’ method of pushing payloads.
- Lock down remote support tools. Inventory SimpleHelp and similar products, patch them, enforce multi-factor authentication and IP allowlists, and require the same of every MSP with access to your network (Cyber Essentials access control and secure configuration).
- Protect backups. Keep at least one immutable or offline copy, and isolate backup consoles from ordinary admin accounts.
- Harden Active Directory. Retire legacy domain controllers, deploy LAPS, tier administrator accounts and make sure Zerologon and PrintNightmare fixes are genuinely in place.
- Alert on tampering. Enable EDR tamper protection, block known vulnerable drivers and alert when security services stop.
- Prepare for extortion without encryption. Monitor large outbound transfers to cloud storage, brief staff on vishing calls that cite stolen data, and keep incident response and legal notification templates ready.
Bottom line
These logs offer a rare look at ransomware affiliates using mainstream AI as a planning and execution assistant, with a human approving each move. The figures are the attackers’ own and should be treated with caution. The lesson for UK organisations is simple: the entry points are old, the pace is new, and the defences that matter are the ones you should already have.
