Posted on

Phantom AI-Assisted INC / The Gentlemen Ransomware Intrusions — Microsoft Sentinel Threat Hunts

Threat Overview

SOCRadar’s October 20, 2026 research, updated October 23, describes exposed operational infrastructure supporting ransomware affiliates using an AI-assisted framework called Phantom. The team recovered source code, OpenCode session history (8,257 messages in 133 sessions), C2 servers, credential records, and 46 INC encryptor builds staged for six victims. A screenshot documented encryption on a victim workstation; staging does not prove all planned deployments succeeded. Operators directed and approved AI-generated actions; this was not a fully autonomous, independently verified campaign against all 62 named organizations. Documented behaviors include exploitation of FortiClient EMS, SimpleHelp and cPanel (some counts are operator claims), unauthorized administrator creation, RMM abuse, credential theft, reverse SOCKS pivoting, BYOVD security impairment, cloud data exfiltration, and .INC encryption.

References

Impacted Systems

  • Fortinet FortiClient EMS (on-premises management server): operator records claim use of CVE-2026-35616 against exposed EMS and creation of privileged accounts/modified VPN connection scripts. Exact affected/fixed builds were not independently verified for this package; use current Fortinet PSIRT guidance.
  • SimpleHelp remote support servers (self-hosted remote-access/RMM role): operators reported exploitation of CVE-2024-57727 and theft of technician credentials; exact affected/fixed versions are not asserted here.
  • cPanel/WHM hosting administration (Internet-facing Linux hosting management): operators claimed use of CVE-2026-41940; affected/fixed build details require vendor confirmation.
  • Windows and Linux endpoints, domain controllers, hypervisors and file servers accessible after foothold: potential lateral movement, credential theft, tunneling and encryption. These systems are *downstream targets*, not automatically vulnerable to the listed edge CVEs.
  • Required conditions: exposed vulnerable management/remote-support service or stolen valid access, followed by network reachability and excessive privilege. No single operating-system version is implied by the attack campaign.

Why this matters

Ransomware affiliates used existing edge, identity and RMM weaknesses as an intrusion chain. For MSSPs, the important detection opportunity is the transition from appliance access to unauthorized remote-management, driver abuse, exfiltration and encryption—not the mere use of an AI model.

Exploitation Status

Researcher-confirmed: exposed C2/infrastructure, tooling, source code, encryptor staging, and a live encryption screenshot. Operator claims (not independently confirmed): 2,236 FortiClient EMS targets, 108 created admins, 242 impacted SimpleHelp IPs, 49+ cPanel breaches. Researcher assessment: shared operational workbench supports both ransomware brands; formal alliance confidence is low. Published IP pivots: 45.227.254.43, .45, .84, 179.60.149.68, 89.185.83.8, 138.124.113.210, 77.110.109.248 (SOCRadar). No evidence that all 62 named organizations were encrypted.

What this hunt looks for

Prepared Sentinel searches for EMS administrative/profile changes, RMM execution, BYOVD driver files, security-tool service interruption, reverse tunnels, reported infrastructure, INC ransomware file modifications, and transfer process-to-network correlation. No customer-specific data has been reviewed or validated.

Required logs

  • CommonSecurityLog with appliance/security-event fields; only when ingested into Microsoft Sentinel.
  • DeviceProcessEvents (Microsoft Defender for Endpoint); only when ingested into Microsoft Sentinel.
  • DeviceFileEvents (Microsoft Defender for Endpoint); only when ingested into Microsoft Sentinel.
  • DeviceProcessEvents and DeviceNetworkEvents with PID/start-time correlation; only when ingested into Microsoft Sentinel.

Hunt 01 — FortiClient EMS privileged-account or VPN script modifications

Signal: High if EMS audit forwarded

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend M=tolower(strcat(tostring(column_ifexists("Message",""))," ",tostring(column_ifexists("AdditionalExtensions",""))))
| where DeviceProduct has "FortiClient" or DeviceProduct has "EMS" or M contains "forticlient ems"
| where (M contains "admin" and (M contains "create" or M contains "added")) or (M contains "vpn" and (M contains "script" or M contains "profile") and (M contains "update" or M contains "modify"))
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, Message, DeviceAction, AdditionalExtensions
| order by TimeGenerated desc

Detection caveat: Only works if FortiClient EMS administration/configuration audit is actually ingested; FortiAnalyzer alone does not guarantee EMS audit.

Hunt 02 — Unauthorized remote-access agent execution from scripts

Signal: High if first-seen RMM installer

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| extend C=tolower(ProcessCommandLine), P=tolower(InitiatingProcessFileName), F=tolower(FileName)
| where C has_any ("simplehelp","meshagent","meshcentral","n-central","atera","anydesk") or F has_any ("simplehelp","meshagent","ncentral","anydesk")
| where P in ("powershell.exe","cmd.exe","wscript.exe","mshta.exe","cscript.exe","bash","sh") or C contains "install"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated desc

Detection caveat: Dual-use RMM; compare approved deployment source and management ownership.

Hunt 03 — BYOVD driver drop and suspicious service execution

Signal: Very high when suspicious driver is written

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where ActionType in~ ("FileCreated","FileModified")
| where FileName in~ ("zam64.sys","zamguard64.sys") or (FolderPath has "\\drivers\\" and FileName contains "zemana")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

Detection caveat: Driver names are known from BYOVD tradecraft, not unique to this crew; confirm signer/hash and installation context.

Hunt 04 — Security product termination via service control

Signal: High when multiple services targeted

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("sc.exe","net.exe","taskkill.exe","powershell.exe","pwsh.exe")
| extend C=tolower(ProcessCommandLine)
| where (C contains " stop " or C contains " delete " or C contains "stop-service" or C contains "taskkill") and (C contains "defender" or C contains "sense" or C contains "crowdstrike" or C contains "sophos" or C contains "kaspersky" or C contains "avast" or C contains "backup")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Detection caveat: Administrative maintenance can resemble this; require change-ticket validation and look for driver load or ransomware activity.

Hunt 05 — Reverse tunnel and proxy tool execution

Signal: Medium-high if unexpected

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| extend C=tolower(ProcessCommandLine), F=tolower(FileName)
| where F in~ ("chisel.exe","chisel","ligolo-agent.exe","ligolo-agent","revsocks.exe","revsocks") or C contains "revsocks" or (C contains "chisel" and C contains "client")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Detection caveat: Dual-use network testing tools; binaries can be renamed and memory-only implants will evade filename matching.

Hunt 06 — Reported ransomware infrastructure contacts

Signal: High when endpoint is not known scanner

let Iocs=dynamic(["45.227.254.43","45.227.254.45","45.227.254.84","179.60.149.68","89.185.83.8","138.124.113.210","77.110.109.248"]);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP in (Iocs) or DestinationIP in (Iocs)
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction, Message
| order by TimeGenerated desc

Detection caveat: These are reported exposed operator servers, not proof every connection is malicious. Confirm time, direction and historical IP reassignment.

Hunt 07 — Mass INC ransomware extension or ransom-note creation

Signal: Very high for ransomware behavior

DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where ActionType in~ ("FileCreated","FileRenamed","FileModified")
| extend RansomNote=FileName =~ "INC-README.txt", Encrypted=FileName endswith ".INC"
| where RansomNote or Encrypted
| summarize Files=count(), Notes=countif(RansomNote), EncryptedFiles=countif(Encrypted), ExamplePaths=make_set(FolderPath,5), First=min(TimeGenerated), Last=max(TimeGenerated) by DeviceId, DeviceName, InitiatingProcessFileName, bin(TimeGenerated,10m)
| where Notes>=1 or EncryptedFiles>=10
| order by Last desc

Detection caveat: .INC may be legitimate in some workflows; the ransom note or mass rename combination is the highest signal.

Hunt 08 — Rclone or Restic export command and network correlation

Signal: High when external transfer follows tool launch

let P=DeviceProcessEvents
| where TimeGenerated>=ago(14d)
| where FileName in~ ("rclone.exe","rclone","restic.exe","restic")
| extend C=tolower(ProcessCommandLine)
| where C contains " copy " or C contains " sync " or C contains " backup " or C contains " move "
| project DeviceId, DeviceName, PID=ProcessId, Started=ProcessCreationTime, ProcessTime=TimeGenerated, FileName, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated>=ago(14d) and RemoteIPType =~ "Public"
| join kind=inner P on DeviceId, $left.InitiatingProcessId == $right.PID
| where InitiatingProcessCreationTime == Started
| where TimeGenerated between (ProcessTime .. ProcessTime+30m)
| project ProcessTime, NetTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by NetTime desc

Detection caveat: Only finds MDE-observed process network connections; approved backup transfers require allowlisting.

Detection Notes

Highest signal: ransom note/mass .INC file changes, confirmed campaign infrastructure connections with context, unapproved EMS privileged changes, and suspicious BYOVD driver files. RMM, Rclone, Restic and tunneling tools are dual-use. CEF EMS audit is not equivalent to Fortinet firewall flow logs. DeviceFileEvents does not show raw UEFI firmware writes; process-network correlation requires consistent PID/start-time fields. Absence of MDE onboarding makes these endpoint hunts unavailable.