Ransomware affiliates ran intrusions through an AI coding agent, exposed server shows

Security firm SOCRadar says an exposed criminal server shows affiliates of the INC and The Gentlemen ransomware groups running break-ins through an AI coding agent, with a human approving each step. Around 62 organisations were targeted, 36 of them in the US, mostly through internet-facing devices with long-known, already-patched flaws. If you run Fortinet FortiClient EMS, SimpleHelp, cPanel/WHM or VPN gateways, confirm they are patched and not exposing admin pages to the internet.

What happened, in plain English

Ransomware is a criminal business: gangs break into an organisation's network, copy sensitive files, sometimes lock (encrypt) the systems, and demand payment. Many gangs work as "ransomware-as-a-service" (RaaS): one group provides the malware and leak site, and "affiliates" do the break-ins for a share of the money.

On October 20, 2026, SOCRadar's Threat Research Unit published research (updated October 23) on a command-and-control (C2) server — the machine attackers use to steer their operations — that had been left with open directories. Inside were the operators' knowledge base, logs of their AI sessions and the source code of their tooling.

The logs show a new division of labour. For each victim, a human operator wrote a "master prompt" describing the target and goals. An AI coding assistant called OpenCode, connected to commercial AI models through the OpenRouter service, then carried out the work: scanning, breaking in, moving through the network and looking for valuable files. The AI was told to "coordinate every action" with the operator, who approved each step.

Think of it as a burglar who no longer picks locks himself: he points an assistant at a street, reads its reports, and says "yes, that door" — but the doors it opens are still the ones left unlocked.

SOCRadar counts 62 organisations at different stages, from reconnaissance only to public extortion. Industrial, manufacturing and energy firms (16.1%) and healthcare and pharmaceutical companies (14.5%) were the most common targets.

Are you affected? What to do now

The way in was overwhelmingly ordinary: known flaws in internet-facing systems and reused passwords. SOCRadar lists three vulnerabilities as actively exploited in this operation — based on the operators' own records, which SOCRadar says it has not independently verified. All three were patched months ago and all are in the Known Exploited Vulnerabilities (KEV) catalog of CISA, the US Cybersecurity and Infrastructure Security Agency:

• CVE-2026-35616, Fortinet FortiClient EMS (endpoint management server) authentication bypass. Fortinet advisory FG-IR-26-099; affects 7.4.5–7.4.6, fixed in 7.4.7 (hotfixes exist for 7.4.5/7.4.6). In KEV since April 6, 2026.
• CVE-2024-57727, SimpleHelp remote-support software path traversal. CISA says SimpleHelp 5.5.7 and earlier are affected; it has been in KEV since February 2025, marked as used in ransomware campaigns, and CISA has warned since June 2025 that ransomware actors exploit it.
• CVE-2026-41940, cPanel & WHM (web-hosting control panel) authentication bypass, CVSS 9.8, fixed in the April 28, 2026 cPanel security update. In KEV since April 30, 2026, also marked as used in ransomware campaigns.

SOCRadar also mentions Ivanti, Citrix, SonicWall and OpenVPN devices being evaluated, and follow-on use of a Roundcube webmail flaw (CVE-2025-49113).

Checklist, in order:

• Inventory every internet-facing management interface: FortiClient EMS, Fortinet and SonicWall gateways, VPNs, SimpleHelp and other remote monitoring and management (RMM) tools, cPanel/WHM, webmail.
• Patch them to the fixed versions above. If you cannot patch today, take the admin interface off the public internet.
• On FortiClient EMS, audit for administrator accounts you did not create and for modified VPN scripts, as SOCRadar recommends.
• Kill password reuse for admin accounts. In one case SOCRadar describes, a single reused password unlocked the VPN, servers, RMM, backup and security tools. Require multi-factor authentication (MFA) and separate admin accounts.
• Ask your managed service provider (MSP) whether its RMM tools are patched and protected by MFA and IP allowlists.
• Keep backups immutable or offline, and make sure endpoint detection and response (EDR) tamper protection is on, with alerts when security services are stopped.
• Brief staff: this playbook uses scripted phone calls ("vishing") to pressure executives, and threatens publication within 24 to 72 hours.
• Detection: SOCRadar publishes IP addresses, domains and file hashes in its post (for example the C2 at 45.227.254[.]43). Load them into your security tools from the original source rather than copying from coverage.

If none of these products face the internet in your environment and admin passwords are unique and MFA-protected, there is nothing new to do.

The expert view

Strip away the AI and this is a familiar ransomware affiliate: edge-device exploits, credential harvesting, domain-admin escalation, data theft over reverse SOCKS tunnels, and extortion priced to the victim's revenue. The novelty is in operations, not in technique.

SOCRadar describes three layers. OpenCode, a general-purpose open-source coding agent, executes the work. "WormGPT-MCP" is a set of 32 Model Context Protocol (MCP) servers — MCP being the standard way to plug tools into an AI agent — covering the attack lifecycle, including one for ransom negotiation and pricing. "Phantom", which the operators call an "Autonomous Red Team Kill Chain Framework", adds 18 skill modules and remote agents disguised as Windows Update components.

Three details stand out. First, "WormGPT" here is only a persona prompt: the underlying models were ordinary commercial ones (SOCRadar names Claude Opus 4.6 and Kimi K3 in the logs). Second, when models refused, the operators did not switch to an uncensored model; they reworded requests using an "Authorized Red Team Assessment Request" template. Pretending to be a legitimate penetration tester remains an effective way past safety filters, which is a problem for model providers more than for defenders. Third, cost: one paid OpenRouter account had spent more than $23,000 when SOCRadar checked on October 5, 2026 — cheap relative to ransom demands in the millions.

This is human-in-the-loop, not autonomous. That matches what we have seen in Gambit Security's and NorForge's reports on agent-driven web-shop attacks and exposed agent control panels, and in the ARTEX research from CrowdStrike and Zscaler. The pattern: agents compress the labour of intrusion and let a small team run many victims at once, while initial access still depends on unpatched edges and reused passwords. That cuts both ways — the controls that stopped human affiliates still stop this.

What remains unknown: SOCRadar notes that per-vulnerability victim counts are the operators' own claims and are unverified. It assesses a shared environment between INC and The Gentlemen operators with moderate-to-high confidence, but a formal alliance with low confidence; its most plausible model is a dedicated tooling and infrastructure provider serving several ransomware partners. Whether the 46 staged encryptor builds were deployed against the six intended victims is unconfirmed. As of November 5, 2026, SOCRadar has not updated its post since October 23, and there is no public statement from OpenRouter or the model providers.

Official sources

• SOCRadar Threat Research Unit — "INC and The Gentlemen Ransomware: Exposed AI Infrastructure" (Oct 20, 2026, updated Oct 23)
• CISA — Known Exploited Vulnerabilities catalog
• CISA — Ransomware actors exploit unpatched SimpleHelp RMM (alert, June 12, 2025)
• cPanel — cPanel & WHM Security Update 04-28-2026
• Coverage: Qualys ThreatPROTECT — FortiClient EMS CVE-2026-35616 (FG-IR-26-099)
• Coverage: Rapid7 — CVE-2026-41940 cPanel & WHM authentication bypass
• Coverage: The Hacker News — Exposed infrastructure reveals how ransomware affiliates used AI agents (Oct 23, 2026)