# AI-Assisted INC and The Gentlemen Ransomware Hit 62 Targets

- URL: https://usa-24.com/inc-ransomware-ai-attacks/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T08:50:07.274Z
- Updated: 2026-10-25T08:50:07.281Z
- Topics: Ransomware, Artificial Intelligence, Cybersecurity Research, FortiClient EMS, Vulnerabilities

> Exposed servers tied to INC and The Gentlemen ransomware affiliates revealed an AI-driven intrusion framework called Phantom and a list of 62 targets, most of them in the US.

## Key takeaways

- SOCRadar researchers found AI-assisted intrusion tooling tied to INC Ransomware and The Gentlemen affiliates on publicly readable servers exposed in late September 2026.
- Researchers estimate 62 organizations were targeted, 36 of them in the United States, and four of the targets appeared on INC or Gentlemen leak sites.
- The Phantom framework includes 18 skill modules for reconnaissance, exploit research and EDR fingerprinting, and a human operator reportedly approves each step.
- Reporting names FortiClient EMS, SimpleHelp and cPanel as exploited entry points, so administrators should confirm those systems are patched and review admin access now.
- Comparitech counted 2,627 ransomware attacks in Q3 2026, up 27 percent from Q2 and 61 percent over Q3 2025, with US entities taking 41 percent of them.

Operators tied to the INC and The Gentlemen ransomware gangs left their attack servers publicly readable, and SOCRadar researchers used what they found to map an AI-assisted intrusion operation. The team estimates the campaign targeted 62 organizations, more than half of them in the United States. The research surfaced around October 20 and 21, and [The Hacker News](https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html) picked it up on October 23.

The findings matter for two reasons. They show criminal groups wiring commercial AI models into the planning and execution of ransomware intrusions. They also show how much an operator's mistakes can reveal. Among the recovered material were Phantom source code, credentials, victim workspaces and AI session histories, according to [SOCRadar's write-up](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/).

## What researchers found on the exposed servers

The exposure traced back to operational security failures in late September 2026. Researchers found publicly accessible directories on seven adversary servers. [Hackread](https://hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/) counted 8,257 AI messages across 133 OpenCode sessions, a volume that suggests the operators relied on AI for far more than occasional help.

The servers also held 46 customized INC encryptor builds prepared for six victims, according to [SecurityOnline](https://securityonline.info/inc-ransomware-affiliates-ai-servers/). Those builds show the operation had moved beyond scouting and into preparing encryption. Not every target got that far. Researchers estimate the 62 organizations include some still at reconnaissance stages and others facing public extortion, and four of them appeared on INC or Gentlemen leak sites.

Hackread's breakdown of listed targets puts industrial and manufacturing at 16.1 percent and healthcare at 14.5 percent. SOCRadar, and reporting that repeats its count, puts 36 of the 62 in the United States.

Public estimates of the operators' spending on commercial AI services also differ. SecurityOnline puts it above $23,920, while [OffSeq](https://radar.offseq.com/threat/inc-and-the-gentlemen-ransomware-exposed-ai-infrastructure-2c3771b43c23942d) says more than $23,000. The gap is small, but the public reporting has not reconciled the two figures.

## How the INC ransomware AI setup works

The centerpiece is a framework called Phantom, which The Hacker News describes as an autonomous red-team kill chain. It runs in live operations through OpenCode. An agent pulls tasks from an external server, runs commands and sends the output back. The framework includes 18 skill modules covering reconnaissance, exploit research and EDR fingerprinting, which means working out which endpoint detection product a machine runs.

That design is what sets this case apart. In a conventional intrusion, an operator runs each tool by hand. Here the agent handles the repetitive work. [LAVX News](https://news.lavx.hu/article/exposed-infrastructure-reveals-ai-driven-ransomware-intrusions-by-inc-and-the-gentlemen-affiliates) reports that the operation executes intrusions through commercial AI models while a human operator approves each step. That checkpoint means the operators keep control over which targets advance, and that is the part defenders most need to disrupt.

SOCRadar's Threat Research Unit assesses that INC and The Gentlemen share an operational environment with moderate-to-high confidence. It rates a formal alliance between them as low confidence. Its most plausible explanation is a shared tooling and infrastructure provider that serves several ransomware partners. If that holds, the gangs may be buying from the same supplier rather than merging, which would make the tooling harder to trace to any single group.

## Which edge devices and CVEs attackers used

Reporting says the attackers exploited edge devices, including FortiClient EMS, SimpleHelp and cPanel. [SecurityOnline](https://securityonline.info/inc-ransomware-affiliates-ai-servers/) and OffSeq name three CVEs in the campaign. The reporting links CVE-2026-35616 to FortiClient EMS and CVE-2024-57727 to SimpleHelp, and it lists CVE-2026-41940 among the flaws used alongside cPanel.

- FortiClient EMS: CVE-2026-35616
- SimpleHelp: CVE-2024-57727
- cPanel: CVE-2026-41940, named among the exploited flaws in the reporting

The sources do not say whether any of these CVEs appear on CISA's Known Exploited Vulnerabilities catalog. Check that catalog directly before you set patch priority, because a listing confirms active exploitation. Perimeter products are a recurring target. A separate campaign, the [k0t hackers' harvest of 70,000 credentials from FortiGate and GlobalProtect devices](https://usa-24.com/fortigate-credentials-stolen-k0t-campaign/), shows the same pattern.

## How the extortion playbook works

According to LAVX News, the gangs examine stolen financial records to set ransom amounts. The goal is to price demands so that a bank or insurer never needs to get involved. The gangs then run scripted vishing calls and threats to notify customers, partners and regulators. Victims reportedly have 24 to 72 hours before their data is posted to leak sites.

This approach squeezes victims from several directions at once. Calls to customers and partners add reputational pressure, and a 24-to-72-hour window leaves little time for forensic review and legal advice. Keeping banks and insurers out of the first conversation also removes two parties that often help victims weigh a demand.

An analyst quoted by [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/) said The Gentlemen has been adding victims' clients to its leak site after a prior ransom payment. A victim that has already paid may still see its own customers named.

## Ransomware Q3 2026 numbers in context

The INC and Gentlemen findings land during a reported surge. [KnowBe4's write-up of a Comparitech report](https://blog.knowbe4.com/report-ransomware-attacks-hit-a-record-high-in-q3-2026) counts 2,627 ransomware attacks in Q3 2026, up 27 percent from Q2 and 61 percent over Q3 2025. US entities accounted for 1,066 of those attacks, or 41 percent. The report states: "All four key sectors saw significantly more attacks in Q3 2026 compared to Q2 2026."

Other counts differ. NordLayer Intelligence counted 2,894 incidents in the same quarter, up 50 percent year over year, as reported by [The IT Nerd](https://itnerd.blog/2026/10/21/guest-post-ransomware-attacks-surge-50-year-over-year-as-the-gentlemen-and-qilin-amplify-attacks/). The two totals reflect different methodologies, so compare the direction of the trend more than the raw counts.

Infosecurity Magazine reports that Qilin logged 357 attacks in Q3 and The Gentlemen logged 342. The IT Nerd piece describes ransomware as a 'golden age' for attackers and points to smaller businesses facing data-only extortion. For a company without a dedicated security team, that pattern means stolen files can become leverage even while its systems keep running. The Gentlemen appears in both the SOCRadar investigation and the Q3 leaderboard, which is one reason its activity deserves attention beyond this single report.

## What US organizations should do now

The reporting does not offer a formal fix, so the steps below are general guidance rather than advice from a specific advisory. They follow the exposure points named in the research.

- Confirm that edge devices and remote management tools are patched, starting with FortiClient EMS, SimpleHelp and cPanel if you run any of them.
- Review exposed admin panels and VPN or management interfaces for accounts you do not recognize, and rotate any credentials that may have been stored on those systems.
- Verify that backups are offline or immutable and that you can restore from them. Run a test restore rather than trusting the backup job status.
- Set a verification procedure for staff before any call about payments, data or system access. Confirm callers through a number already on file, not one they provide.

Federal warnings about other groups, such as the [FBI and CISA advisory on SafePay ransomware](https://usa-24.com/safepay-ransomware-advisory-fbi-cisa/), are worth reading alongside this report because the defensive basics overlap.

## What to watch next

Three developments deserve attention. First, confirmation of how many of the 62 organizations suffered actual breaches. The count is still an estimate, and the reporting separates reconnaissance-only targets from victims who faced extortion. Second, whether the INC and Gentlemen relationship moves beyond SOCRadar's low-confidence view of a formal alliance.

Third, whether AI-run intrusion tools spread. Infosecurity Magazine reported that researchers identified the JadePuffer campaign in July, which it described as the first ransomware attack fully driven by AI. If that label holds, Phantom looks less like an outlier and more like an early model. The sources also do not say which commercial AI providers were used or whether they acted on the activity, and that answer will shape how much scrutiny model makers face. For security teams, the next few weeks are a good time to inventory every internet-facing management tool they run, since an agent working through a target list will not skip the ones nobody remembers.

## Frequently asked questions

### Which groups are behind the INC ransomware AI operation?

Researchers tied the operation to affiliates of INC Ransomware and The Gentlemen, centered on a framework called Phantom. SOCRadar assesses a shared operational environment between the two groups with moderate-to-high confidence, but it rates a formal alliance as low confidence. Its most plausible explanation is a shared tooling and infrastructure provider that serves several ransomware partners.

### How many organizations did the INC and Gentlemen campaign target?

Researchers estimate 62 organizations were targeted, and SOCRadar and related reporting put 36 of them in the United States. Four of the targets appeared on INC or Gentlemen leak sites. The 62 figure is an estimate that mixes reconnaissance-only targets with victims who faced extortion, so the number of confirmed breaches is not established.

### Which products did attackers exploit in the INC ransomware AI campaign?

Reporting says attackers exploited edge devices including FortiClient EMS, SimpleHelp and cPanel. The cited CVEs are CVE-2026-35616, CVE-2024-57727 and CVE-2026-41940. Administrators should confirm those systems are patched and check CISA's Known Exploited Vulnerabilities catalog for each CVE, since the sources do not confirm KEV status.

### How can my organization prepare for vishing-based ransomware extortion?

Set a verification procedure for any call involving payments, data or system access. Confirm the caller through a phone number already on file rather than one the caller provides. Reporting says victims may get only 24 to 72 hours before data is posted, so staff should know who to escalate to immediately.

### How many ransomware attacks were recorded in Q3 2026?

Comparitech counted 2,627 attacks in Q3 2026, up 27 percent from Q2 and 61 percent over Q3 2025, with US entities accounting for 1,066 of them. NordLayer Intelligence counted 2,894 incidents for the same quarter, up 50 percent year over year. The totals differ because the two firms used different methodologies.

## Sources

1. [Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions](https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html)
2. [INC and The Gentlemen Ransomware: Exposed AI Infrastructure](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/)
3. [INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages](https://hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/)
4. [INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors](https://securityonline.info/inc-ransomware-affiliates-ai-servers/)
5. [Exposed infrastructure reveals AI-driven ransomware intrusions by INC and The Gentlemen affiliates](https://news.lavx.hu/article/exposed-infrastructure-reveals-ai-driven-ransomware-intrusions-by-inc-and-the-gentlemen-affiliates)
6. [Report: Ransomware Attacks Hit a Record High in Q3 2026](https://blog.knowbe4.com/report-ransomware-attacks-hit-a-record-high-in-q3-2026)
7. [Q3 2026 Sets New Record for Ransomware Attacks](https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/)
8. [Guest Post: Ransomware attacks surge 50% year-over-year as The Gentlemen and Qilin amplify attacks](https://itnerd.blog/2026/10/21/guest-post-ransomware-attacks-surge-50-year-over-year-as-the-gentlemen-and-qilin-amplify-attacks/)
9. [INC and The Gentlemen Ransomware: Exposed AI Infrastructure](https://radar.offseq.com/threat/inc-and-the-gentlemen-ransomware-exposed-ai-infrastructure-2c3771b43c23942d)