Recent investigations by cybersecurity experts have uncovered a sophisticated ransomware network powered by artificial intelligence (AI), operated by affiliates of two notorious groups, INC and The Gentlemen. The core of their system is an AI-based framework known as Phantom, which facilitates complex intrusions and data theft.
AI-Powered Intrusion Framework
The Phantom framework, a central element of these operations, is managed by Russian-speaking actors who perform both intrusion and extortion tasks. They provide infrastructure services to various partners within the ransomware ecosystem. The attackers exploit vulnerabilities in remote-access systems, such as FortiClient EMS and VPN gateways, using AI-managed knowledge bases to monitor victims and track stolen data.
This system employs an “AI-executed, human-approved” model where operators input specific victim prompts, and AI executes the intrusions via a commercial model called OpenCode. If a model declines to act, operators modify requests to appear as authorized red team assessments, ensuring compliance and execution.
Techniques and Tools Used
Initial system breaches are achieved by targeting public-facing devices, followed by lateral movement, persistence establishment, and eventual ransomware deployment. The operators’ strategies include domain enumeration, credential harvesting, and prioritization of high-value data. Credential reuse is a significant factor, with a single password often unlocking multiple system layers.
The toolkit supporting these activities comprises bespoke and modified open-source tools, including Phantom for offensive security tasks, WormGPT-MCP for module connections, and Ghost C2 for task execution. Additionally, RevSocks is utilized for internal network pivoting and data staging for exfiltration.
Target Sectors and Impact
Analysis indicates that 62 organizations have been targeted, with four listed on data leak sites associated with these ransomware groups. The United States is heavily impacted, accounting for over half of the targets. Industries such as manufacturing, energy, healthcare, and pharmaceuticals are among the primary targets of these attacks.
The threat actors employ AI to assess a victim’s financial capacity, using extortion tactics like scripted calls and threats of data exposure to pressure victims into payment. If demands are unmet, stolen data is published on leak sites. However, the outcomes of these demands remain uncertain as no payment records have been retrieved.
Overall, this exposure highlights the advanced methodologies used by ransomware groups, underscoring the need for robust cybersecurity measures to protect vulnerable sectors from sophisticated AI-driven threats.
