Search — “The Gentlemen”

Researchers at SOCRadar report that affiliates of INC and The Gentlemen ransomware groups ran an AI-driven intrusion ecosystem called Phantom, with human-approved, AI-executed steps via OpenCode and OpenRouter-hosted commercial models, targeting an estimated 62 organizations, more than half in the US. Sources say edge and remote-access systems were exploited (FortiClient EMS, SimpleHelp, cPanel, VPN gateways), followed by domain enumeration, credential harvesting, reverse-SOCKS tunnelling, and data theft. Hunters should look for RevSocks or Ghost C2 activity, BYOVD use of the Zemana driver zam64.sys, and reuse of a single password across VPN, server, RMM, and backup accounts.

Group-IB and NyxLab attribute a large campaign to the actor k0t, who reportedly scans for exposed Fortinet FortiGate and Palo Alto GlobalProtect devices, exploits CVE-2025-64446 and CVE-2026-0257 or brute-forces credentials, and establishes an OpenConnect VPN foothold. Sources describe persistence via MeshCentral, Atera, Teramind, AnyDesk-like tools and AdaptixC2, Rclone exfiltration to Wasabi and MEGA, and AD enumeration with Impacket and Mimikatz. Hunters should look for OpenConnect sessions from edge devices, unexpected RMM agents, and Rclone or AdaptixC2 activity; the sources say more than 70,000 credentials were identified, and the actor is assessed as a possible access broker for Qilin and The Gentlemen.

Rapid7's Q3 2026 threat analysis reports that high-severity vulnerabilities were exploited within an average of three days of disclosure, with 71% exploited in the first seven days, and 79% classed as remote with no credentials or local user involvement. The report covers ransomware leaders (The Gentlemen, Qilin, INC Ransom, DeadLock, Krybit), nation-state groups, dark web access broker activity, and AI use in only 8% of tracked incidents. No specific CVEs, malware hashes, or detection queries are printed in the source, so hunting value is limited to reviewing patch timelines and monitoring for unexpected AI API usage.