Operators tied to the INC and The Gentlemen ransomware gangs left their attack servers publicly readable, and SOCRadar researchers used what they found to map an AI-assisted intrusion operation. The team estimates the campaign targeted 62 organizations, more than half of them in the United States. The research surfaced around October 20 and 21, and The Hacker News picked it up on October 23.

The findings matter for two reasons. They show criminal groups wiring commercial AI models into the planning and execution of ransomware intrusions. They also show how much an operator's mistakes can reveal. Among the recovered material were Phantom source code, credentials, victim workspaces and AI session histories, according to SOCRadar's write-up.

What researchers found on the exposed servers

The exposure traced back to operational security failures in late September 2026. Researchers found publicly accessible directories on seven adversary servers. Hackread counted 8,257 AI messages across 133 OpenCode sessions, a volume that suggests the operators relied on AI for far more than occasional help.

The servers also held 46 customized INC encryptor builds prepared for six victims, according to SecurityOnline. Those builds show the operation had moved beyond scouting and into preparing encryption. Not every target got that far. Researchers estimate the 62 organizations include some still at reconnaissance stages and others facing public extortion, and four of them appeared on INC or Gentlemen leak sites.

Hackread's breakdown of listed targets puts industrial and manufacturing at 16.1 percent and healthcare at 14.5 percent. SOCRadar, and reporting that repeats its count, puts 36 of the 62 in the United States.

Public estimates of the operators' spending on commercial AI services also differ. SecurityOnline puts it above $23,920, while OffSeq says more than $23,000. The gap is small, but the public reporting has not reconciled the two figures.

How the INC ransomware AI setup works

The centerpiece is a framework called Phantom, which The Hacker News describes as an autonomous red-team kill chain. It runs in live operations through OpenCode. An agent pulls tasks from an external server, runs commands and sends the output back. The framework includes 18 skill modules covering reconnaissance, exploit research and EDR fingerprinting, which means working out which endpoint detection product a machine runs.

That design is what sets this case apart. In a conventional intrusion, an operator runs each tool by hand. Here the agent handles the repetitive work. LAVX News reports that the operation executes intrusions through commercial AI models while a human operator approves each step. That checkpoint means the operators keep control over which targets advance, and that is the part defenders most need to disrupt.

SOCRadar's Threat Research Unit assesses that INC and The Gentlemen share an operational environment with moderate-to-high confidence. It rates a formal alliance between them as low confidence. Its most plausible explanation is a shared tooling and infrastructure provider that serves several ransomware partners. If that holds, the gangs may be buying from the same supplier rather than merging, which would make the tooling harder to trace to any single group.

Which edge devices and CVEs attackers used

Reporting says the attackers exploited edge devices, including FortiClient EMS, SimpleHelp and cPanel. SecurityOnline and OffSeq name three CVEs in the campaign. The reporting links CVE-2026-35616 to FortiClient EMS and CVE-2024-57727 to SimpleHelp, and it lists CVE-2026-41940 among the flaws used alongside cPanel.

  • FortiClient EMS: CVE-2026-35616
  • SimpleHelp: CVE-2024-57727
  • cPanel: CVE-2026-41940, named among the exploited flaws in the reporting

The sources do not say whether any of these CVEs appear on CISA's Known Exploited Vulnerabilities catalog. Check that catalog directly before you set patch priority, because a listing confirms active exploitation. Perimeter products are a recurring target. A separate campaign, the k0t hackers' harvest of 70,000 credentials from FortiGate and GlobalProtect devices, shows the same pattern.

How the extortion playbook works

According to LAVX News, the gangs examine stolen financial records to set ransom amounts. The goal is to price demands so that a bank or insurer never needs to get involved. The gangs then run scripted vishing calls and threats to notify customers, partners and regulators. Victims reportedly have 24 to 72 hours before their data is posted to leak sites.

This approach squeezes victims from several directions at once. Calls to customers and partners add reputational pressure, and a 24-to-72-hour window leaves little time for forensic review and legal advice. Keeping banks and insurers out of the first conversation also removes two parties that often help victims weigh a demand.

An analyst quoted by Infosecurity Magazine said The Gentlemen has been adding victims' clients to its leak site after a prior ransom payment. A victim that has already paid may still see its own customers named.

Ransomware Q3 2026 numbers in context

The INC and Gentlemen findings land during a reported surge. KnowBe4's write-up of a Comparitech report counts 2,627 ransomware attacks in Q3 2026, up 27 percent from Q2 and 61 percent over Q3 2025. US entities accounted for 1,066 of those attacks, or 41 percent. The report states: "All four key sectors saw significantly more attacks in Q3 2026 compared to Q2 2026."

Other counts differ. NordLayer Intelligence counted 2,894 incidents in the same quarter, up 50 percent year over year, as reported by The IT Nerd. The two totals reflect different methodologies, so compare the direction of the trend more than the raw counts.

Infosecurity Magazine reports that Qilin logged 357 attacks in Q3 and The Gentlemen logged 342. The IT Nerd piece describes ransomware as a 'golden age' for attackers and points to smaller businesses facing data-only extortion. For a company without a dedicated security team, that pattern means stolen files can become leverage even while its systems keep running. The Gentlemen appears in both the SOCRadar investigation and the Q3 leaderboard, which is one reason its activity deserves attention beyond this single report.

What US organizations should do now

The reporting does not offer a formal fix, so the steps below are general guidance rather than advice from a specific advisory. They follow the exposure points named in the research.

  • Confirm that edge devices and remote management tools are patched, starting with FortiClient EMS, SimpleHelp and cPanel if you run any of them.
  • Review exposed admin panels and VPN or management interfaces for accounts you do not recognize, and rotate any credentials that may have been stored on those systems.
  • Verify that backups are offline or immutable and that you can restore from them. Run a test restore rather than trusting the backup job status.
  • Set a verification procedure for staff before any call about payments, data or system access. Confirm callers through a number already on file, not one they provide.

Federal warnings about other groups, such as the FBI and CISA advisory on SafePay ransomware, are worth reading alongside this report because the defensive basics overlap.

What to watch next

Three developments deserve attention. First, confirmation of how many of the 62 organizations suffered actual breaches. The count is still an estimate, and the reporting separates reconnaissance-only targets from victims who faced extortion. Second, whether the INC and Gentlemen relationship moves beyond SOCRadar's low-confidence view of a formal alliance.

Third, whether AI-run intrusion tools spread. Infosecurity Magazine reported that researchers identified the JadePuffer campaign in July, which it described as the first ransomware attack fully driven by AI. If that label holds, Phantom looks less like an outlier and more like an early model. The sources also do not say which commercial AI providers were used or whether they acted on the activity, and that answer will shape how much scrutiny model makers face. For security teams, the next few weeks are a good time to inventory every internet-facing management tool they run, since an agent working through a target list will not skip the ones nobody remembers.