"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways," SOCRadar said.
Phantom: an AI-powered "Autonomous Red Team Kill Chain Framework"
Researchers uncovered an automated intrusion ecosystem centered on an AI-driven framework the operators call Phantom. According to the reporting, Phantom is deployed in live operations via OpenCode and uses OpenRouter-hosted commercial models; an agent communicates with an external server to retrieve tasks, execute commands, and return outputs. SOCRadar notes Phantom supports 18 skill modules covering functions such as reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting.
The operation combines machine decision-making with human oversight: attackers used an "AI-executed, human-approved operating structure" in which a human provides a victim-specific prompt and reviews every step, while the AI carries out the intrusion tasks. If a model refuses a prompt, operators sometimes rewrote requests as an "authorized red team assessment" rather than merely switching models.
Exploited vulnerabilities and scaled initial access
Initial access was achieved through large-scale exploitation of exposed edge and remote-access services. Operator records list active exploitation of CVE-2024-57727 (SimpleHelp path traversal), CVE-2026-35616 (Fortinet FortiClient authentication bypass), and CVE-2026-41940 (cPanel/WHM authentication bypass). The records also show CVE-2026-15409 (SonicWall SMA 1000 SSRF) was staged for targeting with no confirmed compromise, and that several exploits were "developed or referenced" including CVE-2026-63030 (WordPress wp2shell), CVE-2026-42208 (LiteLLM SQL injection) and CVE-2026-9082 (Drupal SQL injection).
SOCRadar reported the actors "engaged in widespread exploitation of exposed internet services, specifically targeting FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls." The exposed infrastructure captured at 45.227.254[.]43 logged 8,257 messages across 133 sessions, documenting the scale and granularity of the operation.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildToolkit: Ghost C2, RevSocks, WormGPT-MCP, and auxiliary programs
The operation combined bespoke frameworks, modified open-source tools, and compiled binaries. Key components named in the analysis include:
- WormGPT-MCP: a set of 32 Model Context Protocol servers linking the AI system to 32 functional modules, spanning reconnaissance through extortion.
- Ghost C2: three generations of polymorphic implants that beacon to remote servers over Cloudflare, Telegram, or DNS and maintain persistent tasking on compromised endpoints.
- RevSocks: a reverse SOCKS5 framework used to pivot inside victim networks and stage exfiltration.
- QuickLine (a Cloudflare-fronted Mythic agent), a Quick Heal/Seqrite EDR killer that abuses the Zemana driver "zam64.sys" in a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.
SOCRadar also recorded use of an AI-managed knowledge base to track victims, stolen credentials and campaign progress, alongside records of mixed success against enterprise EDRs.
Operational lifecycle, credential reuse, and data-extortion tactics
"Once inside, the operators followed a recurring lifecycle: enumerate the domain, escalate to domain admin where possible, harvest credentials with stealer tooling, prioritize finance, HR, legal and executive files, and collect them over reverse-SOCKS tunnels," SOCRadar said. Operator logs emphasize credential reuse as a force multiplier — in one recorded case, a single reused password unlocked VPNs, servers, RMM, backup and security management platforms simultaneously.
The extortion campaign is data-centric and methodical. Analysts found dozens of AI-authored extortion records showing the actors examined stolen financials to determine an amount a victim could likely pay without bank or insurer involvement, delivered masked proof samples, and applied pressure through scripted vishing calls and threats to notify customers, partners and regulators. Victims were given 24–72 hours to pay before stolen data was posted on the INC and The Gentlemen data leak sites.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: The combination of AI-managed knowledge bases, Phantom's 18 modules, and modular C2 and pivot tooling like RevSocks underscores a need to monitor exposed edge services (FortiClient EMS, SimpleHelp, cPanel, VPN gateways) and to scrutinize credential reuse patterns.
- Policymakers and regulators: The actors explicitly threatened to notify customers, partners and regulators as part of their pressure tactics; the records showing targeted financials and compressed 24–72 hour deadlines may factor into discussions about disclosure timelines and reporting obligations.
- Affected enterprises and procurement leaders: The operation's reliance on exploited remote management and access products — and an instance where a single password unlocked multiple critical systems — highlights the operational risk of shared credentials and external-facing management endpoints.
A total of 62 organizations were estimated to have been targeted by the operation; four of those organizations ended up listed on the INC and The Gentlemen data leak sites. The U.S. accounted for more than 50% of the targets, and primary sectors hit included industrial, manufacturing and energy, followed by healthcare and pharmaceuticals. SOCRadar recorded that no cryptocurrency wallet or payment record tied to the extortion demands was recovered, leaving the final outcomes of the ransom demands unknown.
The exposed directories and session logs offer a narrow, concrete window into an intrusion model that blends AI automation and human judgment. The unanswered practical question left on the record is not whether such a workflow can exist — the logs prove it — but how many defenders will detect it in time when attackers combine scale, targeted exploitation of CVEs, credential reuse and an AI-managed campaign ledger.
