EP 65 - Ghosts, Phantoms, and Terrible OPSEC - Inside an AI-Assisted Ransomware Crew

Good morning, good afternoon, or good evening, whenever you may be. And welcome back to another episode of The Sock Brief. I'm your host Andrew, and since we're officially in Halloween week, I went looking for something a little spooky for today's episode. And fortunately, the ransomware ecosystem delivered.

Today we're talking about phantoms, ghosts, the gentlemen, thousands of exposed conversations, and a group of ransomware operators who apparently used artificial intelligence to help manage their attacks, but forgot to secure their own server. So grab some candy, turn the lights down, and let's talk about what may be one of my favorite examples of bad attacker OPSEC this year. On October 20th, researchers with SockRadar published an investigation into infrastructure connected to affiliates working with Inc.

Ransomware and another ransomware operator known as the Gentleman. And an important distinction I want to make right at the beginning here is SOCRadar says it has high confidence that the infrastructure was being used by operators associated with both ransomware brands. But they do not have high confidence that Inc. Ransomware and the Gentlemen themselves are formally partnered.

The more likely explanation is that we're looking at shared operators, affiliates, or a tooling provider servicing multiple ransomware groups. And that's how the ransomware as a service ecosystem works nowadays. The person actually breaking into your network isn't necessarily the person who wrote the ransomware, and they may work with several different groups. But regardless of exactly how those relationships work, researchers got an incredible look behind the curtain because one of the attacker's command and control servers was sitting publicly accessible on the internet, and it exposed basically everything.

Their AI session history, their victim knowledge base, credentials, source code, attack tooling, and the source code for something the attackers called Phantom. Phantom was described by its creators as an autonomous red team kill chain framework, which sounded appropriately spooky for this week. But we're going to come back to that word autonomous in a minute. The exposed server didn't just reveal itself.

Configuration files, credentials, and other information sitting on that machine led researchers to six more attacker-controlled servers. So imagine a horror movie where somebody opens the door to one creepy basement and discovers six additional basements. Except instead of finding skeletons, researchers found ransomware tooling, and the attackers had apparently been busy. SockRadar recovered 8,257 AI messages across 133 sessions.

There were knowledge bases tracking victims, stolen credentials, notes about attack progress, custom tooling, and 46 customized ink ransomware encryptor builds that had been prepared for six different victims. Researchers also found evidence showing ransomware actually running on at least one victim workstation. So this wasn't somebody building a cool offensive security project in their basement and pretending to be a ransomware group. This was operational infrastructure.

And here's where artificial intelligence enters the story. The attackers were using an open source coding agent called OpenCode. And OpenCode was then connected through OpenRouter to commercial AI models, including Claude Opus 4.6 and Kimi K3.

The AI wasn't just being asked, write me a phishing email. It was being integrated into the actual intrusion workflow. According to the recovered conversations, the AI helped plan reconnaissance, select techniques, generate commands, analyze results, debug tools, organize stolen information, track victims, and even help prepare extortion material. One open router account associated with the operation had consumed almost $24,000 worth of AI usage.

Apparently, software as a service subscriptions are now part of the ransomware operating budget too. Now, I've already seen some headlines describing this as completely autonomous AI ransomware, but that's not quite accurate, because humans were still involved. SOC Radar describes the operating model as AI executed, human approved. Each victim would essentially get a master prompt, the AI would determine what it wanted to do next.

Then the human operator was supposed to approve the action before it continued. There was even an instruction in their workflow telling the AI to coordinate every action with the operator. So this wasn't Skynet waking up and deciding it needed some Bitcoin. There was still a person sitting behind the keyboard.

But that person could delegate a huge portion of the technical work to AI, and that's arguably the more realistic threat for SOC teams right now. And there's another detail here that I found particularly funny. The attackers had a collection of tools labeled WormGPT. And if you've been following cybercrime and AI, WormGPT has become kind of a generic name for supposedly unrestricted criminal AI models.

Except that's apparently not what was happening here. SOCRADAR found that the operators were still using normal commercial models, and WormGPT was basically a persona in prompt layer. When the AI refused to help with something obviously malicious, the operators would reframe the request as an authorized red team assessment. Apparently, cybercriminal prompt engineering has reached the no, seriously, Claude, I have permission stage.

And sometimes it worked. The attacker didn't necessarily need some secret underground criminal AI model. They could take commercially available tools, wrap them in the right prompts, connect them to offensive tooling, and keep trying different wording. The custom Phantom framework itself was pretty extensive.

Sock Radar says it contained 18 different skill modules, it had an autopilot capability, it connected AI agents to offensive security tools, and some of its implants masqueraded as Windows update components. They also found something called Ghost C2, and Ghost C2 included several generations of implants that could communicate through HTTPS, Cloudflare, Telegram, or DNS. The operation also used common tools defenders will recognize, like Chisel, Legolo, Mythic, remote access software, cloud storage utilities, credential harvesting, and tools designed to interfere with endpoint security.

And that's where we get the first major lesson for SOX here. For all the AI in this story, the underlying attacks weren't magic. They still had to get into networks. And the attackers were doing that primarily through things defenders already understand: internet-facing systems, known vulnerabilities, remote management platforms, VPN gateways, and stolen credentials.

According to the operator's own records, they targeted afforded client EMS, SimpleHelp, CPanel, and WHM, and several other VPN products. Some of the numbers and the attacker's databases are huge. But we need to be careful here because those counts come from the criminal's own notes and aren't independently verified yet. What's much more useful is the methodology.

Find exposed edge device, exploit known vulnerability, create administrator account, steal credentials, pivot into internal systems, use legitimate remote management software where possible, escalate privileges, steal information, then deploy ransomware or begin extortion. The AI may make that process faster, but the process itself should look very familiar. And there's a really good example of this in one of the victim environments. According to SOCRadar, credential reuse became a huge force multiplier.

One reused password reportedly provided access to the victim's VPN, servers, remote management tooling, backup infrastructure, and security management systems. One password, multiple critical platforms. You can give the attacker the world's greatest AI model. You can give them an autonomous attack framework.

You could even give them 35 MCP servers and thousands of exploit proofs of concept. But sometimes the thing that actually wrecks your organization is somebody reusing a password. This is why I don't think the defensive takeaway from the story should be how do we detect AI hackers? I'm not sure that's even the right question.

If an AI agent runs Bloodhound instead of a human running Bloodhound, Bloodhound still ran. If AI decides to execute PowerShell, PowerShell's still executed. If AI tells the attacker to create a domain admin, a new domain admin still appears. The implementation behind the keyboard may change, the behaviors inside your network don't magically disappear.

And that's good news for SOCS. Because we don't necessarily need a detection rule that says alert if Claude is hacking us, we need good behavioral detection. SOCRADAR published several useful hunting opportunities from the exposed infrastructure. On FortiClient EMS systems, look for unexpected privilege accounts.

They specifically documented account patterns including FCT underscore SVC naming. Look for unauthorized changes to VPN profiles, look for missing audit logs, look for remote management software appearing where it isn't supposed to exist. They also documented persistence through a scheduled task named RealTech Audio SVC, and that's another useful hunting lead. Once the attackers were inside an environment, they used tunneling utilities including RevSox, Chisel, and Legolo.

They harvested credentials, accessed Active Directory, used remote management tools, searched specifically for valuable data. That includes finance, HR, legal, executive documents, exactly the kinds of data you'd expect someone to prioritize if their ultimate goal was extortion. For exfiltration, researchers documented tools including Rustic and R clone. Again, legitimate tools, and that's worth emphasizing.

Attackers don't get extra points for writing custom malware. If a perfectly legitimate backup or synchronization utility moves stolen data just fine, they're happy to use it too. So monitor those tools based on context. R clone running on an approved backup server at 2 in the morning?

Might be normal. R clone suddenly appearing on the CFO's workstation and uploading hundreds of gigs to an unfamiliar cloud account? Probably a giant red flag. The operation also had tools intended to disable security products.

One used a familiar technique called Bring Your Own Vulnerable Driver or BYOVD. Essentially, the attacker installs a legitimate but vulnerable kernel driver. Because that driver has trusted kernel level access, that the attacker exploits the vulnerability inside it to interfere with security products. That might include stopping services or deleting protected files.

SOCRADAR says the attackers had mixed success against enterprise EDR products, which is another useful reminder. Threat actors test things too. Sometimes their tools fail, exploits fail, or scripts break. The difference now is that AI may help them troubleshoot those failures a lot faster.

And that brings me to the part of this story I think matters most. AI doesn't have to invent some revolutionary new hacking technique to change cybersecurity. It can change the economics of existing techniques. A ransomware affiliate may not need 10 highly skilled operators anymore.

Maybe one or two people can supervise AI agents that handle reconnaissance, generate commands, parse results, and keep track of multiple victims at the same time. The AI doesn't get tired. It doesn't forget which credentials belong to which victim. It can summarize 10,000 lines of output in seconds.

It can modify a script when the first version doesn't work, and it can help a mediocre attacker perform tasks that previously required significantly more expertise. That doesn't mean every script kitty suddenly becomes an elite threat actor, but it may raise the floor, and it may increase the speed and number of attacks defenders have to deal with. There's also an important flip side to this story. The same thing that made the attackers more efficient created an incredible evidence trail.

The AI remembered everything. Thousands of messages, commands, attack plans, victim information, debugging sessions, operational discussions, all sitting inside the infrastructure. And SOC Radar actually points out that the group's reliance on AI memory became one of its weaknesses. In traditional hacking, an attacker might work manually and leave relatively little documentation behind.

These operators effectively created meeting notes for their own crimes, then left the filing cabinet unlocked. Which brings us back to the terrible OPSEC. And I think that it's worth remembering when we talk about sophisticated threat actors. We sometimes imagine the attacker as this almost supernatural adversary.

They never make mistakes, they know everything, they're always one step ahead, and that's just not really the reality of things. Attackers misconfigure servers, they reuse passwords, expose directories, forget logs, leave API keys lying around, accidentally reveal infrastructure, make the same kind of mistakes defenders make, and sometimes one small mistake exposes an entire operation. In this case, researchers started with one exposed server and ended up mapping seven. So yes, AI assisted ransomware as serious, but apparently the AI assistant didn't tell them, hey guys, maybe disable directory listing.

So what should SOX actually do with all of this? First, don't panic because someone put the word AI in front of ransomware. Focus on the TTPs, patch internet-facing systems quickly, that's especially VPNs, RMM platforms, and centralized management systems. Those are incredibly attractive because compromising one management platform can potentially provide access to everything it manages.

Restrict management interfaces from the public internet whenever possible, use MFA, use IP restrictions where appropriate, and monitor for new administrator accounts. Second, inventory your remote management tools. Things like simple help, mesh central, nCentral, anydesk, screen connect, whatever your organization actually uses. Know what is approved, then alert when something else appears.

Third, watch your security controls themselves. EDR suddenly stops? Why? A security service gets deleted?

Why? A vulnerable driver unexpectedly loads immediately before endpoint protection disappears? That's probably worth investigating. Fourth, monitor large outbound transfers and cloud storage utilities, especially when those tools appear on systems that don't normally use them.

And finally, don't reuse passwords across your VPN, backup environment, RMM system, and security console. It's hard to believe that this needs to be the lesson from a story involving autonomous AI attack frameworks, but here we are. So here's my challenge for your team this week. Since it's Halloween, go ghost hunting.

But instead of walking around in an abandoned hospital with an EMF meter, look for ghost infrastructure inside your own network. Remote access tools nobody remembers installing, old service accounts, management interface nobody owns, scheduled tasks nobody recognizes, legacy VPN appliances, internet facing systems that were supposed to be decommissioned six months ago, and credentials that have quietly been reused across multiple critical platforms. Those are the things attackers are actually looking for.

The haunted server probably isn't possessed. It's just running server 2012 and nobody knows the password. And I think that's the perfect lesson to end on this week. The scary part of this story isn't Phantom, it isn't GoC2, and it isn't even AI.

The scary part is how effectively attackers can combine new technology with old weaknesses. Unpatched edge devices, weak credential hygiene, overly exposed management interfaces, legitimate tools being abused, poor monitoring. AI just helps them do all of that faster. But there's also something strangely comforting about knowing that even an AI-assisted ransomware operation with custom tooling, commercial language models, its own kill chain framework, and almost $24,000 worth of usage can still be taken apart because somebody forgot to secure their web server.

Sometimes cybersecurity really does come down to the basics. And that's a wrap for this episode of the SOC Brief. If your team has been looking at AI-assisted attacks, or you decide to do some ghost hunting around your own environment this week, hit us up through our website or via social media. And if you find a forgotten server in a dark corner of your network, maybe don't split up to investigate it.

That's how every horror movie starts. Keep your eyes open, keep sharpening those skills, and we'll talk soon. Stay secure out there. Bye.