Ochiq infratuzilma ransomware sheriklari AI agentlar yordamida hujumlarni qanday amalga oshirganini ochib berdi

Kiberxavfsizlik tadqiqotchilari INC va The Gentlemen ransomware guruhlari sheriklari tomonidan boshqariladigan sun'iy intellekt (AI) asosidagi kirish ekotizimini aniqladilar.

Operatsiyaning markazida "Autonomous Red Team Kill Chain Framework" deb ataladigan Phantom nomli tizim turadi. Tahdid aktori rus tilida so'zlashuvchi deb baholanadi va u kirish hamda ma'lumotlar shantaji operatori, shuningdek, ransomware ekotizimidagi turli sheriklarni qo'llab-quvvatlovchi infratuzilma provayderi sifatida faoliyat yuritadi.

"Operatorlar chekka va masofaviy kirish tizimlarini keng ko'lamda ekspluatatsiya qildilar, jumladan FortiClient EMS, SimpleHelp, cPanel va VPN shlyuzlari," deb xabar berdi SOCRadar. "Ular jabrlanuvchilarni, o'g'irlangan hisob ma'lumotlarini va kampaniya jarayonini kuzatish uchun AI tomonidan boshqariladigan bilim bazalaridan foydalanganlar."

Kampaniyani belgilovchi muhim jihat — bu "AI tomonidan bajariladigan, inson tomonidan tasdiqlanadigan operatsion tuzilma" bo'lib, unda inson operator jabrlanuvchiga xos so'rovni taqdim etadi va har bir qadamni tekshiradi, kirishlar esa OpenCode orqali OpenRouter-hosted tijorat modellari yordamida amalga oshiriladi.

45.227.254[.]43 manzilidagi ochiq katalogni tekshirish natijasida 133 sessiya davomida 8 257 ta xabar qayd etilgani aniqlandi. Agar modellar so'rovlarga javob berishdan bosh tortsa, operator so'rovlarni shunchaki modellarni almashtirish o'rniga, ruxsat etilgan qizil jamoa baholashi sifatida qayta yozgani aniqlangan.

Dastlabki kirish keng ko'lamda ochiq chekka qurilmalarni ekspluatatsiya qilish orqali amalga oshiriladi, shundan so'ng hujumchilar yon tomonga harakatlanadilar, doimiy kirishni o'rnatadilar, ma'lumotlarni o'g'irlaydilar va ransomware joylashtirish tomon harakat qiladilar. Operator yozuvlari hujumlar quyidagi zaifliklarni ekspluatatsiya qilishni o'z ichiga olganini ko'rsatadi:

• CVE-2024-57727 (SimpleHelp yo'l o'tish zaifligi) (Faol ekspluatatsiya qilinmoqda)
• CVE-2026-35616 (Fortinet FortiClient autentifikatsiya chetlab o'tish) (Faol ekspluatatsiya qilinmoqda)
• CVE-2026-41940 (cPanel/WHM autentifikatsiya chetlab o'tish) (Faol ekspluatatsiya qilinmoqda)
• CVE-2026-15409 (SonicWall SMA 1000 SSRF) (Nishonga olingan, tasdiqlangan buzilish yo'q)
• CVE-2026-63030 (WordPress wp2shell) (Ishlab chiqilgan)
• CVE-2026-42208 (LiteLLM SQL in'ektsiyasi) (Ishlab chiqilgan yoki havola qilingan)
• CVE-2026-9082 (Drupal SQL in'ektsiyasi) (Ishlab chiqilgan yoki havola qilingan)

"Ichkariga kirgach, operatorlar takrorlanadigan hayot siklini kuzatdilar: domenni ro'yxatga olish, iloji bo'lsa domen administratoriga ko'tarilish, o'g'irlagich vositalari bilan hisob ma'lumotlarini yig'ish, moliya, kadrlar, huquqiy va rahbarlik fayllarini ustuvor qilish va ularni teskari-SOCKS tunnelari orqali yig'ish," deb ta'kidladi SOCRadar.

"Hisob ma'lumotlarining qayta ishlatilishi asosiy kuchaytiruvchi omil bo'ldi; bir holatda, bitta qayta ishlatilgan parol bir vaqtning o'zida VPN, serverlar, RMM, zaxira nusxalari va xavfsizlikni boshqarish platformalarini ochdi. Xavfsizlik mahsulotlari BYOVD killer va yuklovchi darajadagi chetlab o'tish bilan zaiflashtirildi, garchi operatorlarning o'z yozuvlari korporativ EDRlarga qarshi aralash natijalarni qayd etgan bo'lsa-da."

Tahdid aktoriga maqsadlariga erishishda yordam beradigan turli vositalar to'plami maxsus ramkalar, o'zgartirilgan ochiq manba vositalari va kompilyatsiya qilingan binar fayllardan iborat:

• Phantom — AI asosidagi hujum xavfsizligi va penetratsion sinov ramkasi bo'lib, u jonli operatsiyalarda OpenCode orqali joylashtiriladi va tashqi server bilan aloqa qiladigan agentdan foydalanib, vazifalarni olish, buyruqlarni bajarish va natijalarni qaytarish uchun foydalaniladi. U 18 ta mahorat modulini qo'llab-quvvatlaydi, jumladan razvedka, binar teskari muhandislik, ekspluatatsiya tadqiqoti, steganografiya, telemetriya baholashi va EDR barmoq izini aniqlash.
• WormGPT-MCP — AI tizimini 32 ta turli modulga ulaydigan 32 ta Model Context Protocol (MCP) serverlari to'plami bo'lib, ular razvedkadan shantajgacha bo'lgan funksiyalarni qamrab oladi.
• Ghost C2 — Cloudflare, Telegram yoki DNS orqali masofaviy server bilan aloqa qiladigan va vazifalarni bajaradigan, shuningdek, buzilgan nuqtalarda doimiy mayoqni saqlaydigan uch avlod polimorf implantlar to'plami.
• RevSocks — jabrlanuvchi tarmoqlari ichida harakatlanish va ma'lumotlarni o'g'irlash uchun sahnalashtirish uchun ishlatiladigan teskari SOCKS5 ramkasi.

Boshqa vositalar qatoriga Cloudflare-fronted Mythic agenti QuickLine, Zemana drayverini ("zam64.sys") BYOVD hujumi doirasida suiiste'mol qiladigan Quick Heal/Seqrite EDR killeri va rks3 hamda BackupAgent kabi o'g'irlash dasturlari kiradi.

O'nlab AI tomonidan yozilgan shantaj yozuvlarini tahlil qilish shuni ko'rsatadiki, tahdid aktorlari ma'lumotlarga yo'naltirilgan yondashuvni qabul qiladilar. Bu o'g'irlangan moliyaviy ma'lumotlarni tekshirish orqali jabrlanuvchi bank yoki sug'urtachini jalb qilmasdan to'lay oladigan miqdorni aniqlash, so'ngra niqoblangan isbot namunalarini yuborish va mijozlar, sheriklar va tartibga soluvchilarga xabar berish tahdidi bilan skriptlangan vishing qo'ng'iroqlari orqali bosimni kuchaytirishni o'z ichiga oladi.

Agar jabrlanuvchi 24-72 soatlik muddat ichida to'lamasa, o'g'irlangan ma'lumotlar oxir-oqibat ma'lumotlar sizdirish saytida e'lon qilinadi. Biroq, bu to'lov talablarining yakuniy natijalari noma'lum, chunki hech qanday kriptovalyuta hamyoni yoki to'lov yozuvi topilmagan.

Operatsiya tomonidan jami 62 ta tashkilot nishonga olingan deb baholanadi, ulardan to'rttasi INC va The Gentlemen ransomware ma'lumotlar sizdirish saytlarida ro'yxatga olingan. AQSh nishonlarning 50% dan ortig'ini tashkil etadi. Hujumlar asosan sanoat, ishlab chiqarish va energetika sohalariga qaratilgan, keyin sog'liqni saqlash va farmatsevtika tashkilotlari keladi.

"Ushbu ochiq infratuzilma bo'ylab aktorlar ochiq internet xizmatlarini keng ko'lamda ekspluatatsiya qildilar, xususan FortiClient EMS shlyuzlari, Ivanti/Citrix/SonicWall/OpenVPN shlyuzlari, SimpleHelp masofaviy boshqaruv serverlari va cPanel xosting nazoratlarini nishonga oldilar," deb ta'kidladi SOCRadar.

"Shu bilan birga, ular Phantom ramkasi orqali operatsiyalarni muvofiqlashtirdilar, tarmoq harakati uchun RevSocks teskari-SOCKS proksi-serverlarini o'rnatdilar, Ghost C2 variantlarini joylashtirdilar va AI tomonidan boshqariladigan bilim bazalaridan foydalanib, jabrlanuvchi telemetriyasini, buzilgan hisob ma'lumotlarini va faol kampaniya holatlarini sinchkovlik bilan qayd etdilar."

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an infrastructure provider supporting different partners across the ransomware ecosystem.

"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways," SOCRadar said. "They used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress."

A notable aspect that defines the campaign is its "AI-executed, human-approved operating structure" in which a human operator provides a victim-specific prompt and reviews every step, while the intrusions themselves are executed through OpenCode with OpenRouter-hosted commercial models.

An examination of the exposed directory at 45.227.254[.]43 has revealed the activity logged 8,257 messages across 133 sessions. Should the models refuse to act on the prompts, the operator has been found to rewrite requests as an authorized red team assessment instead of simply switching models.

Initial access is achieved by exploiting public-facing edge devices at scale, following which the attackers move laterally, establish persistence, exfiltrate data, and escalate toward ransomware deployment. Operator records indicate that the attacks involve the exploitation of the following flaws -

• CVE-2024-57727 (SimpleHelp path traversal) (Actively exploited)
• CVE-2026-35616 (Fortinet FortiClient authentication bypass) (Actively exploited)
• CVE-2026-41940 (cPanel/WHM authentication bypass) (Actively exploited)
• CVE-2026-15409 (SonicWall SMA 1000 SSRF) (Staged for targeting, no confirmed compromise)
• CVE-2026-63030 (WordPress wp2shell) (Developed)
• CVE-2026-42208 (LiteLLM SQL injection) (Developed or referenced)
• CVE-2026-9082 (Drupal SQL injection) (Developed or referenced)

"Once inside, the operators followed a recurring lifecycle: enumerate the domain, escalate to domain admin where possible, harvest credentials with stealer tooling, prioritize finance, HR, legal and executive files, and collect them over reverse-SOCKS tunnels," SOCRadar said.

"Credential reuse was the main force multiplier; in one case, a single reused password unlocked the VPN, servers, RMM, backup and security management platforms at once. Security products were impaired with a BYOVD killer and loader-level evasion, although the operators' own logs record mixed results against enterprise EDRs."

Supporting the threat actor in their goals is a diverse toolkit comprising bespoke frameworks, modified open-source tools, and compiled binaries -

• Phantom, an AI-powered offensive security and penetration testing framework that's deployed in live operations via OpenCode and employs an agent that communicates with an external server to retrieve tasks, execute commands, and return outputs. It supports 18 skill modules to facilitate reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting, among others.
• WormGPT-MCP, a set of 32 Model Context Protocol (MCP) servers connecting the AI system to 32 different modules that span functions ranging from reconnaissance to extortion.
• Ghost C2, a collection of three generations of polymorphic implants that communicate with a remote server over Cloudflare, Telegram, or DNS, and execute tasking and maintain persistent beacons on compromised endpoints.
• RevSocks, a reverse SOCKS5 framework used to pivot inside victim networks and stage data for exfiltration.

Other tools include a Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.

Analysis of dozens of AI-authored extortion records shows that the threat actors adopt a data-centric approach. It involves examining the stolen financials to determine the amount a victim can pay without having to involve a bank or an insurer, and then sending masked proof samples and ramping up pressure through scripted vishing calls and threatening to notify customers, partners, and regulators.

The stolen data is eventually published on the data leak site if the victim fails to pay within a 24-72 hour deadline. That said, the final outcomes of these ransom demands are unknown as no cryptocurrency wallet or payment record has been recovered.

A total of 62 organizations are estimated to have been targeted by the operation, out of which four of them ended up being listed on the data leak sites for INC and The Gentlemen ransomware. The U.S. accounts for more than 50% of the targets. The attacks also primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.

"Across this exposed infrastructure, the actors engaged in widespread exploitation of exposed internet services, specifically targeting FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls," SOCRadar said.

"Concurrently, they orchestrated operations via the Phantom framework, established RevSocks reverse-SOCKS proxies for network pivoting, deployed Ghost C2 variants, and utilized AI-managed knowledge bases to meticulously log victim telemetry, compromised credentials, and active campaign statuses."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.