Latest
  1. Johns Hopkins Bayview tells 3,182 patients an employee put their health data into a public AI tool
  2. China’s AI compute access expected to double in 2027, with US-designed chips about 65 per cent
  3. UK commits £100m to national AI Biosecurity Lab
  4. Moonshot AI releases Kimi K3.1 Pro with 1-million-token context window
  5. Residents in Newport and Cardiff oppose hyperscale datacentres near homes
  6. Study: Grok 4.7 picked Republicans in 92% of forced midterm answers, GPT-6.1 Sol picked Democrats in 97%
  7. Attackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says
  8. Elvis Presley’s rightsholders sue Anthropic over training on 274 songs

Latest / Frontier models and safety

IncidentFrontierGovernmentInternationalReported

Ransomware affiliates ran intrusions through AI agents, an exposed server shows

See how this story connects

Source: The Hacker NewsAlso reported by SOCRadar

SOCRadar found an exposed server used by affiliates of the INC and The Gentlemen ransomware groups, assessed to be Russian-speaking, that ran intrusions through an AI framework called Phantom. A human operator wrote a prompt for each victim and approved every step, while the attacks ran through OpenCode on commercial models hosted by OpenRouter; the logs hold 8,257 messages across 133 sessions. When a model refused, the operator rewrote the request as an authorised red-team assessment.

Why it matters

The logs show commercial models used to exploit FortiClient EMS, SimpleHelp, cPanel and VPN gateways at scale, with refusals passed by rewording the request.

When
23 Oct 2026
ID
WTA-N-2026-0396
Who
SOCRadar, OpenRouter
System
commercial models on OpenRouter, driven by the Phantom framework through OpenCode
Operator
affiliates of the INC and The Gentlemen ransomware groups
Type
AI-executed, human-approved intrusions and data extortion
Status
disclosed; disclosed by SOCRadar · Incident ledger

Summary by wheresthe.ai, from The Hacker News and the reporting credited above. We could not open the primary document, so it is marked Reported. Checked against the source on 24 Oct 2026.

Read the original at The Hacker News

Source copy: download the page as saved on 24 Oct 2026 (PDF). Also held by the Internet Archive.

Next stop on this Storyline: What happened nextAttackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says

Cite this story

WTA-N-2026-0396: “Ransomware affiliates ran intrusions through AI agents, an exposed server shows.” wheresthe.ai, 23 Oct 2026. https://wheresthe.ai/d/intl-ransomware-affiliates-ran-intrusions-through-ai-agents-2026-10/ (source: The Hacker News).

Spotted an error? Email [email protected].