Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Cybersecurity researchers have uncovered an AI-driven system used by affiliates of the INC and The Gentlemen ransomware groups to carry out intrusions. The system, which includes a framework called Phantom, is an autonomous red team kill chain framework. This framework is central to the operation, which is run by a Russian-speaking threat actor. The threat actor is involved in both intrusion and data extortion operations. The discovery provides insight into the infrastructure used by these ransomware affiliates. The Phantom framework is a key component of the AI-driven intrusion ecosystem.