INC and The Gentlemen Ransomware Expose AI-Powered Attack Infrastructure

Summary

Affiliates linked to INC and The Gentlemen ransomware groups are using an AI-driven intrusion ecosystem to automate reconnaissance, command generation, and data triage. The operators rely on a custom framework called Phantom together with commercial LLMs to support large-scale intrusions. The ecosystem was uncovered after major OPSEC failures exposed command-and-control infrastructure and stored AI session logs.

Investigation

The investigation began after researchers discovered an exposed command-and-control server at 45.227.254.43 containing open directories with Phantom source code and AI session databases. Analysis of configuration files and exposed credentials subsequently led to six additional adversary-controlled servers. Researchers uncovered a highly automated workflow in which AI handles much of the technical execution while human operators retain overall supervision.

Mitigation

Organizations should prioritize patching edge devices, particularly FortiClient EMS, SimpleHelp, and cPanel, to eliminate common initial access vectors. Enforcing multi-factor authentication (MFA) across all RMM, VPN, and remote access platforms is critical to reduce credential reuse risk. Defenders should also enable EDR tamper protection and monitor for unauthorized security service termination or loading of known vulnerable drivers.

Response

When malicious activity is detected, isolate affected edge devices and review all administrative accounts in EMS and RMM platforms for unauthorized additions. Inspect VPN connection scripts for suspicious modifications and immediately rotate compromised credentials. Conduct a comprehensive review of scheduled tasks and active reverse SOCKS tunnels to identify and terminate persistent C2 channels.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access and intends to establish a robust tunnel for lateral movement. First, they attempt to run a renamed version of a tunneling tool; however, to test the environment’s detection capabilities, we will execute the command using the literal string “Ligolo” to ensure the rule triggers. Second, the adversary deploys a Python-based beacon. To avoid detection by network security appliances that inspect TLS certificates, the adversary configures the Python script to ignore TLS verification, simulating the tls_verify_disabled telemetry pattern expected by the rule.

• Regression Test Script:

    # Simulation Script: Triggering Detection Rule via String Match and Python TLS Bypass
  
    Write-Host "[+] Starting Simulation..." -ForegroundColor Cyan
  
    # 1. Triggering selection1: Command Line contains 'Ligolo'
    Write-Host "[+] Executing Tunneling Tool simulation (Ligolo)..." -ForegroundColor Yellow
    Start-Process "cmd.exe" -ArgumentList "/c echo Running Ligolo Tunneling Engine..." -WindowStyle Hidden
  
    # 2. Triggering selection2: Python with simulated 'tls_verify_disabled' metadata
    # Note: Since 'tls_verify_disabled' is likely a custom metadata field from an EDR, 
    # we simulate the behavior that would generate such a tag.
    Write-Host "[+] Executing Python Beacon simulation (TLS Verification Disabled)..." -ForegroundColor Yellow
  
    # This command simulates a python process performing a request while explicitly 
    # suppressing SSL verification, which would be flagged by advanced EDRs.
    $pythonCode = "import urllib.request, ssl; context = ssl._create_unverified_context(); urllib.request.urlopen('https://expired.badssl.com/', context=context)"
    python -c $pythonCode
  
    Write-Host "[+] Simulation complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

    # Cleanup: No files were created in this simulation, but we ensure no stray processes remain.
    Stop-Process -Name "python" -ErrorAction SilentlyContinue
    Write-Host "[+] Cleanup complete." -ForegroundColor Cyan