Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Ransomware affiliates use AI agents for intrusions, leveraging an 'Autonomous Red Team Kill Chain Framework' called
Summary
Cybersecurity researchers have uncovered an AI-driven intrusion operation used by affiliates of the INC and The Gentlemen ransomware groups. This ecosystem is built around a framework named Phantom, which functions as an 'Autonomous Red Team Kill Chain Framework.' The threat actor, believed to be Russian-speaking, engages in both data extortion and intrusion activities.
The lesson from this incident
Full lessonRansomware affiliates leveraged an autonomous AI-based framework called Phantom to conduct end-to-end intrusion operations, exposing how threat actors are industrialising attack chains with minimal human intervention. The root problem lies in exposed, unmonitored infrastructure that provided attackers with visible footholds to probe and exploit. This matters because AI-assisted kill chains dramatically compress the time between initial access and data extortion, leaving defenders little margin to detect and respond. As ransomware groups commoditise AI tooling among affiliates, any organisation with internet-facing assets and weak monitoring becomes a high-value, low-effort target.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Deception and honeypots
An attacker who gets in quietly can explore the network for weeks before any alarm goes off.