AI security
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have uncovered an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups, according to The Hacker News. The operation centers on a framework called Phantom, described as an 'Autonomous Red Team Kill Chain Framework.'
Cybersecurity researchers have discovered an artificial intelligence-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups, The Hacker News reported. The findings came to light through exposed infrastructure, giving researchers an unusual view into how the threat actor employed AI agents during intrusions.
Central to the operation is a framework the actor refers to as Phantom, described as an "Autonomous Red Team Kill Chain Framework." According to the report, ransomware affiliates used the tooling to execute intrusions, pointing to an operating model in which AI agents take on work that has traditionally been performed manually by human operators.
The threat actor behind the framework is assessed to be Russian-speaking. Researchers describe the operator as functioning both as an intrusion operator and a data-extortion operator in support of ransomware activity.
The case is notable because it documents ransomware affiliates delegating portions of the intrusion process itself to autonomous or semi-autonomous agents, rather than limiting AI use to auxiliary tasks. The available reporting does not fully detail how widely Phantom has been deployed or how it compares with conventional attack tooling.
The exposure of the infrastructure gave investigators direct visibility into the setup, a relatively uncommon opportunity when examining ransomware affiliate operations. According to The Hacker News, the discovery stands as an early, concrete example of ransomware-linked actors operationalizing AI agents within real-world intrusion activity.
Source: The Hacker News
