Exposed Servers Reveal AI-Powered Ransomware Operations by INC and The Gentlemen Affiliates
Cybersecurity firm SOCRadar uncovered seven exposed servers tied to INC Ransomware and The Gentlemen ransomware affiliates, exposing sensitive attack infrastructure, including AI-driven tools, stolen credentials, and 46 custom ransomware encryptor builds. The findings, detailed in a report published on October 20, provide a rare glimpse into how ransomware groups leverage AI while maintaining human oversight.
Researchers from SOCRadar’s Threat Research Unit (STRU) recovered 8,257 AI chat messages across 133 OpenCode sessions, alongside $23,920 in AI API spending by the operators. The threat actors used commercial AI models, including Claude Opus 4.6 and Kimi K3, to assist in reconnaissance, credential analysis, and report drafting though all actions required explicit human approval. When AI models rejected malicious requests, operators rephrased prompts as "Authorized Red Team Assessment Requests" to bypass restrictions.
The exposed data also revealed targeting strategies against vulnerable systems, including:
- CVE-2026-41940 (cPanel): Claimed 49 breaches of hosting providers.
- CVE-2024-57727 (SimpleHelp): Scans of 4,922 servers reportedly yielded 427 administrator passwords, with 242 unique IPs impacted.
- CVE-2026-35616 (FortiClient EMS): Records indicated 2,236 targets, 108 new admin accounts, and 4,140 managed endpoints.
These figures, sourced from attacker logs, remain unverified. The servers also contained WormGPT-labeled MCP servers, Phantom (a custom attack framework), and tools to disable security products.
Among the 62 named organizations in the operators’ records, 36 were U.S.-based, with industrial/manufacturing (16.1%) and healthcare/pharmaceutical (14.5%) sectors most frequently targeted. While 46 INC encryptor builds were prepared for six victims ahead of an October 1, 2026, deployment, the report does not confirm all attacks occurred. However, a September 30 screenshot showed an encryptor active on a victim workstation, proving at least one successful breach.
The data also outlined an extortion strategy involving stolen financial and business records, with threats to leak data to customers, partners, and regulators. The findings underscore how ransomware groups integrate AI into attacks while retaining human control over critical decisions.
Source: https://hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/
Fortinet TPRM report: https://www.rankiteo.com/company/fortinet
"id": "for1792592756",
"linkid": "fortinet",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['Industrial/Manufacturing (16.1%)',
'Healthcare/Pharmaceutical (14.5%)'],
'location': 'U.S.-based (36 organizations)',
'name': '62 named organizations (specific names not '
'disclosed)',
'type': ['Industrial/Manufacturing',
'Healthcare/Pharmaceutical',
'Other']}],
'attack_vector': ['Exposed servers', 'Vulnerability exploitation'],
'data_breach': {'data_encryption': 'Yes (ransomware encryptors)',
'data_exfiltration': 'Yes',
'number_of_records_exposed': '8,257 AI chat messages, 427 '
'administrator passwords, 4,140 '
'managed endpoints',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Credentials',
'AI chat messages',
'Financial records',
'Business records',
'Personally identifiable '
'information']},
'date_publicly_disclosed': '2024-10-20',
'description': 'Cybersecurity firm SOCRadar uncovered seven exposed servers '
'tied to INC Ransomware and The Gentlemen ransomware '
'affiliates, exposing sensitive attack infrastructure, '
'including AI-driven tools, stolen credentials, and 46 custom '
'ransomware encryptor builds. The findings provide a rare '
'glimpse into how ransomware groups leverage AI while '
'maintaining human oversight.',
'impact': {'brand_reputation_impact': 'Threats to leak data to customers, '
'partners, and regulators',
'data_compromised': 'Stolen credentials, AI chat messages, custom '
'ransomware encryptor builds, financial and '
'business records',
'identity_theft_risk': 'Personally identifiable information at '
'risk',
'operational_impact': 'Potential encryption of victim systems, '
'data exfiltration',
'systems_affected': '4,922 SimpleHelp servers scanned, 2,236 '
'FortiClient EMS targets, 427 administrator '
'passwords compromised'},
'initial_access_broker': {'entry_point': ['CVE-2026-41940 (cPanel)',
'CVE-2024-57727 (SimpleHelp)',
'CVE-2026-35616 (FortiClient EMS)'],
'high_value_targets': 'Industrial/Manufacturing, '
'Healthcare/Pharmaceutical'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Ransomware groups integrate AI into attacks while '
'retaining human control over critical decisions. AI tools '
'are used for reconnaissance, credential analysis, and '
'report drafting but require explicit human approval.',
'motivation': ['Financial gain', 'Data extortion'],
'post_incident_analysis': {'root_causes': 'Exposed servers, unpatched '
'vulnerabilities, use of AI tools '
'for malicious purposes'},
'ransomware': {'data_encryption': 'Yes (46 custom encryptor builds)',
'data_exfiltration': 'Yes',
'ransomware_strain': 'INC Ransomware'},
'references': [{'date_accessed': '2024-10-20', 'source': 'SOCRadar Report'}],
'response': {'third_party_assistance': 'SOCRadar Threat Research Unit (STRU)'},
'threat_actor': ['INC Ransomware', 'The Gentlemen Affiliates'],
'title': 'Exposed Servers Reveal AI-Powered Ransomware Operations by INC and '
'The Gentlemen Affiliates',
'type': 'Ransomware',
'vulnerability_exploited': ['CVE-2026-41940 (cPanel)',
'CVE-2024-57727 (SimpleHelp)',
'CVE-2026-35616 (FortiClient EMS)']}