# AI-Powered Ransomware Framework 'Phantom' Uncovered by Researchers

*Published October 26, 2026*
*Source: [https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html](https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/ai-powered-ransomware-framework-phantom-uncovered-by-researchers) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Cybersecurity researchers have unearthed a sophisticated AI-driven intrusion ecosystem operated by affiliates of the ransomware groups INC and The Gentlemen. At the heart of this operation lies 'Phantom', an 'Autonomous Red Team Kill Chain Framework'. The primary actors, believed to be Russian-speaking, serve as both intruders and data-extortionists. They also provide infrastructure support to various partners within the ransomware landscape.

The attackers have exploited edge and remote-access systems such as FortiClient EMS, SimpleHelp, cPanel, and VPN gateways on a large scale. They employ AI-managed knowledge bases to track victims, stolen credentials, and the progress of their campaigns. A distinctive feature of this campaign is its 'AI-executed, human-approved' operating method. Human operators input victim-specific prompts and oversee each step, while the actual intrusions are conducted using OpenCode with OpenRouter-hosted commercial models.

An investigation into the exposed directory at a specific IP address has revealed the activity logged 8,257 messages across 133 sessions. If models refuse to act on prompts, operators modify requests as authorized red team assessments rather than changing models. Initial access is obtained by exploiting public-facing edge devices, after which attackers move laterally, establish persistence, exfiltrate data, and escalate towards deploying ransomware.

The threat actors follow a recurring attack lifecycle, which includes domain enumeration, escalating to domain admin when possible, harvesting credentials with stealer tools, and prioritizing financial, HR, legal, and executive files for collection over reverse-SOCKS tunnels. Credential reuse is a significant force multiplier, with one reused password unlocking multiple platforms at once. Security products are impaired with a BYOVD killer and loader-level evasion, though results against enterprise EDRs are mixed.

Supporting the attackers is a toolkit comprising custom frameworks, modified open-source tools, and compiled binaries. Additional tools include the Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer using the Zemana driver, and exfiltration programs such as rks3 and BackupAgent. Analysis of AI-authored extortion records shows a data-centric approach, examining stolen financials to determine extortion amounts, and using scripted vishing calls to apply pressure.

The operation has targeted 62 organizations, with four appearing on data leak sites. The majority of targets are in the U.S., focusing on industrial, manufacturing, energy, healthcare, and pharmaceutical sectors. The actors exploited exposed internet services and conducted operations through the Phantom framework, utilizing tools like RevSocks reverse-SOCKS proxies and Ghost C2 variants to log victim telemetry and campaign statuses.