AI-driven ransomware group targets SMB edge devices and cPanel servers

Cybersecurity researchers have uncovered a sophisticated ransomware operation leveraging artificial intelligence to automate intrusions into small and mid-sized business networks. Affiliates of the INC and The Gentlemen ransomware groups utilized a custom framework called Phantom to exploit common edge devices, including Fortinet gateways and cPanel hosting controls, throughout late 2026.

What happened

The campaign was orchestrated by a Russian-speaking threat actor who functions as both an intrusion operator and an infrastructure provider for other ransomware partners. Central to their success was the Phantom framework, an "Autonomous Red Team Kill Chain Framework" that executes attacks using commercial AI models hosted on OpenRouter via OpenCode. While the AI handles the technical execution of commands and reconnaissance, a human operator remains in the loop, providing specific prompts and reviewing every step to ensure the attack proceeds as planned. If an AI model refuses a malicious prompt, the operator simply rewrites the request to frame it as an authorized red team assessment, bypassing safety filters without switching models.

SOCRadar researchers discovered this ecosystem after analyzing an exposed directory at IP address 45.227.254[.]43. The logs revealed 8,257 messages across 133 sessions, detailing how the attackers managed victim telemetry, stolen credentials, and campaign progress through AI-managed knowledge bases. The operation targeted 62 organizations, primarily in the United States, with a focus on industrial, manufacturing, energy, healthcare, and pharmaceutical sectors. Four of these victims were eventually listed on the data leak sites associated with INC and The Gentlemen ransomware groups.

Key details

• The attackers actively exploited CVE-2024-57727 in SimpleHelp, CVE-2026-35616 in Fortinet FortiClient, and CVE-2026-41940 in cPanel/WHM to gain initial access.
• Phantom supports 18 skill modules, including reconnaissance, binary reverse engineering, and EDR fingerprinting, connected via 32 Model Context Protocol servers known as WormGPT-MCP.
• Credential reuse was a primary force multiplier, with one instance showing a single password granting access to VPNs, servers, RMM tools, and backup platforms simultaneously.
• The group used RevSocks reverse-SOCKS5 tunnels for lateral movement and data exfiltration, prioritizing finance, HR, legal, and executive files.
• Extortion tactics were data-centric, using AI to analyze stolen financial records and determine ransom amounts that victims could pay without involving banks or insurers.
• Other developed or referenced exploits included vulnerabilities in SonicWall SMA 1000, WordPress wp2shell, LiteLLM, and Drupal.

Background

To understand the severity of this campaign, it helps to recognize the role of edge devices in modern IT infrastructure. Edge devices like firewalls, VPN gateways, and hosting control panels sit at the boundary between a company's internal network and the public internet. They are frequent targets because they are always online and often manage critical access points. When these devices have unpatched vulnerabilities, such as the authentication bypasses found in Fortinet and cPanel products, attackers can slip inside without needing to trick employees with phishing emails.

The use of AI in this context represents a shift from manual hacking to automated, scalable intrusion. Traditional ransomware attacks require significant human effort to map a network and find weaknesses. By using an AI agent like Phantom, the attackers can rapidly process information, adapt to different network environments, and execute complex sequences of commands with minimal human intervention. The "human-approved" structure ensures that while the AI does the heavy lifting, strategic decisions remain under human control, making the operation both fast and precise.

Why it matters

For teams that run their own software and manage their own infrastructure, this incident highlights the critical risk of unpatched edge services. Small and mid-sized companies often rely on solutions like cPanel for web hosting or Fortinet for secure remote access. These tools are convenient but become single points of failure if not meticulously maintained. The fact that attackers specifically targeted these widely used platforms means that any delay in applying security updates can leave your entire network exposed to automated intrusion attempts.

Furthermore, the reliance on credential reuse demonstrates that perimeter security alone is insufficient. Once the attackers breached the edge devices, they used stolen passwords to move laterally across the network, accessing backup systems and security management platforms. This suggests that even if you patch your external-facing services, weak internal password hygiene can allow attackers to maintain persistence and exfiltrate sensitive data. The use of reverse-SOCKS tunnels also indicates that traditional network monitoring might miss this traffic if it is not specifically looking for unusual proxy connections.

What you can do

• Immediately patch Fortinet FortiClient, cPanel/WHM, and SimpleHelp installations to address the actively exploited vulnerabilities CVE-2026-35616, CVE-2026-41940, and CVE-2024-57727.
• Enforce unique, strong passwords for all administrative accounts, especially those with access to VPNs, RMM tools, and backup systems, to prevent credential reuse attacks.
• Monitor for unusual outbound traffic patterns, such as reverse-SOCKS connections, which may indicate lateral movement or data exfiltration within your network.
• Restrict administrative access to edge devices by limiting login attempts to specific IP addresses and requiring multi-factor authentication wherever possible.
• Review and harden your backup configurations to ensure they are not accessible using the same credentials as your primary production systems.
• Implement automated heartbeat monitoring for critical maintenance jobs and backups to detect if security tools or data protection processes have been silently disabled.