[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhGqHTJtDEJISSrF4bBlmyzd9ey7AZIJ7hjeKZ9GBUAI":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"69430de8-a0ad-43e4-a5c6-1d9dbb611c45","Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions","exposed-infrastructure-reveals-how-ransomware-affiliates-used-ai-agents-to-execu-6fb95e","Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an \"Autonomous Red Team Kill Chain Framework\" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an","Cybersecurity researchers have uncovered an AI-driven intrusion operation used by affiliates of the INC and The Gentlemen ransomware groups. This ecosystem is built around a framework named Phantom, which functions as an 'Autonomous Red Team Kill Chain Framework.' The threat actor, believed to be Russian-speaking, engages in both data extortion and intrusion activities.","Ransomware affiliates use AI agents for intrusions, leveraging an 'Autonomous Red Team Kill Chain Framework' called","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fexposed-infrastructure-reveals-how.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg6gkXKzxUypnUKbTuo7Xq-8TSUpDD8TNF5XEG-bV6zcA7V3z_cO2pJeTiX1KIFi-rFNX5SOlMY93oGQpfQUuWOl0RJ35nM1XeIqu2ZV4aAIZXEd9RXQVQk0rMmeI67ysGsTJ1OXLIQg2LvGjMLHCQQ8dgqalHaBE9yCZKwIOVjHCD_lOTlsP1HdBziZ3Sb\u002Fs1600\u002Fai-hacker-kimi.jpg","2026-10-23T17:50:47+00:00","2026-10-23T18:00:08.759158+00:00",8,[17,20,22,25],{"name":18,"type":19},"INC","threat_actor",{"name":21,"type":19},"The Gentlemen",{"name":23,"type":24},"Phantom","campaign",{"name":26,"type":27},"AI agents","technology","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":28,"icon":30,"name":31,"slug":32},null,"Ransomware","ransomware",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":85,"name":86,"problem":87,"products":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":114,"name":115,"problem":116,"products":117},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortideceptor","FortiDeceptor","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortideceptor","Deception platform that deploys decoys to expose attacks coming from outside or inside the network.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-ex","Defused EX","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fex","Managed honeypots placed next to your VPNs, firewalls and gateways and made to look like your own infrastructure, alerting on attacks aimed at your perimeter.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"tracebit","Tracebit","\u002Fvendor-logos\u002Ftracebit.png","tracebit-canaries","Tracebit Security Canaries","https:\u002F\u002Ftracebit.com\u002Fplatform\u002Fcredentials-and-artifacts","Deploys and maintains decoy credentials, cloud resources and files across AWS, Azure, Google Cloud, Kubernetes, CI\u002FCD, identity providers and workstations.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"ai-driven-ransomware-framework-exploits-exposed-infrastructure","AI-Driven Ransomware Framework Exploits Exposed Infrastructure","Ransomware affiliates leveraged an autonomous AI-based framework called Phantom to conduct end-to-end intrusion operations, exposing how threat actors are industrialising attack chains with minimal human intervention. The root problem lies in exposed, unmonitored infrastructure that provided attackers with visible footholds to probe and exploit. This matters because AI-assisted kill chains dramatically compress the time between initial access and data extortion, leaving defenders little margin to detect and respond. As ransomware groups commoditise AI tooling among affiliates, any organisation with internet-facing assets and weak monitoring becomes a high-value, low-effort target.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":156,"MITRE ATT&CK T1566: Phishing":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 17: Incident Response Management":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 requires organisations to implement risk-based security measures including incident handling and monitoring — precisely the controls needed to detect and limit AI-automated intrusion chains targeting essential services.","Ransomware affiliates using frameworks like Phantom typically combine automated exploitation with social engineering for initial access, making defence against all initial access vectors critical.","Systematically identifying and remediating vulnerabilities in internet-facing systems would close the entry points that the Phantom framework relies on for automated exploitation.","AI-driven kill chains compress attack timelines dramatically; a tested, well-defined incident response plan is essential to contain ransomware affiliates before data exfiltration and encryption occur.","The exposed infrastructure exploited by Phantom affiliates highlights the need for continuous scanning and timely remediation of internet-facing assets before autonomous tools can enumerate and exploit them.","A formal technical vulnerability management process would ensure exposed infrastructure is inventoried, assessed, and patched before ransomware affiliates can weaponise it through automated frameworks.","Restricting and hardening access to exposed infrastructure would reduce the ability of autonomous agents to pivot laterally through the environment after initial compromise."]