8,257 AI Messages and 62 Victims: Inside the Phantom Ransomware Framework

8,257 messages. 133 sessions. $23,920 in model credits. That is the accounting on an AI-assisted ransomware operation whose operators left the directory listing on their own command server open to the internet. SOCRadar's Threat Research Unit pulled the source code, the credentials and the full AI session history off that host in late September 2026, then followed its configs to six more servers. The crew had worked 62 named organizations, built 46 custom INC encryptors, and packed three victim bundles on September 30 for a deployment wave the next morning.

Every vulnerability they exploited was already published, already scored and already fixed by the vendor. The newest flaw in their confirmed-compromise set, a cPanel and WHM authentication bypass, had been public for 155 days when they packed those encryptors. The oldest had been public for more than 20 months. The models read advisories, chose targets and drove the same three plays across thousands of hosts. They did not find a bug.

Who this reaches

Check three things. Run FortiClient EMS 7.4.5 or 7.4.6, SimpleHelp 5.5.7 or earlier, or cPanel and WHM on a server you manage, and this operation has already scanned you or a host that looks exactly like you. The second check is harder, because it covers somebody else's server: an outside IT provider with remote access into your network holds that exposure on your behalf, at a patch level you cannot see. SOCRadar recovered 427 administrator passwords from SimpleHelp servers and records that technician credentials led straight to those technicians' clients.

If you run none of the three and no third party holds remote access to your estate, the hunt queries below are not yours and you can skip them. Read the last two sections anyway. The victim profile is the part that generalizes: of the 35 organizations SOCRadar could classify by revenue, 27 were at $250 million or less. The target list was drawn from companies the size of the ones reading this, and it reached 62 of them with a team working a single shift, 06:00 to 14:00 UTC.

The myth the headline carries

"AI-operated ransomware" reads as something new and unstoppable. The recovered logs describe something smaller and more useful to know. The framework, which the operators call Phantom and advertise to partners as an autonomous red team kill chain, is a wrapper: 18 skill modules, a routing engine, an autopilot orchestrator, and agents written in Python and Go that masquerade as Windows Update components. Every module automates a technique that was already public.

The autonomy claim does not survive the session history either. The operators drove commercial models through OpenCode over OpenRouter APIs, and the workflow waited for human approval before each step. SOCRadar names two models in the routing config, anthropic/claude-opus-4.6 and moonshotai/kimi-k3. There is no bespoke criminal model here. The much-publicised "WormGPT" in their toolkit turned out to be a persona prompt, and when a model refused a request the operators did not swap it out: they reworded the request as an "Authorized Red Team Assessment Request" and sent it again. A social-engineering trick against a safety filter is a long way from an AI that writes its own exploits.

Treat the breathless version of this story as noise. The accurate version is worse for defenders in a different way, and the next two sections are why.

Three published CVEs did all the work

Here is the confirmed-exploitation set, with the dates that matter. Every one of these had a patch available before the operation touched it.

• FortiClient EMS, CVE-2026-35616 (CVSS 9.8, published April 4, 2026). Improper access control in versions 7.4.5 through 7.4.6 lets an unauthenticated attacker run commands. SOCRadar counts 2,236 targets, 108 administrator accounts created, and 4,140 managed endpoints reachable through them. Payloads went out through modified VPN connection scripts, which is to say through the EMS console's legitimate function.
• SimpleHelp, CVE-2024-57727 (CVSS 7.5, published January 15, 2025). Path traversal in 5.5.7 and earlier hands an unauthenticated attacker the server configuration files, including hashed passwords. 4,922 servers scanned, 427 administrator passwords recovered, 242 unique client IP addresses affected. CISA added this one to the Known Exploited Vulnerabilities catalog on February 13, 2025, and published advisory AA25-163A in June 2025 after ransomware actors used it to reach a utility billing provider's downstream customers. Sixteen months after that advisory, it was still the highest-yield entry point in this crew's toolkit.
• cPanel and WHM, CVE-2026-41940 (CVSS v4.0 9.3, published April 29, 2026). An authentication bypass in the login flow. The operators claim more than 49 small hosting providers breached, used to reach hosted mail and webmail.

The rest of their catalogue is a record of failure. ZeroLogon was attempted against two domain controllers. PrintNightmare failed. A Fortinet SAML bypass failed. LDAPNightmare was not exploitable in their environment. A PAN-OS zero-day attempt produced no confirmed code execution. Give a capable model a large budget and a target list and it still cannot make an unexploitable condition exploitable.

What the automation actually bought

Scale, and the clock. A small team working one shift does not normally scan 4,922 remote-support servers, triage the results, and carry 62 organizations at five different depths of compromise at once. This one did, and the depth distribution is the tell: 12 organizations at reconnaissance only, 28 at foothold, 14 at domain-level compromise, 4 at the encryption stage, 4 already listed for extortion. That is a pipeline, staffed by software, with humans approving the steps that matter.

The operational consequence is the one I would put in front of a board. The gap between a vulnerability becoming public and somebody capable arriving at your door used to be a function of attacker attention, and attention was scarce. It is no longer scarce. The SimpleHelp flaw sat unpatched on thousands of hosts for 20 months because exploiting all of them by hand was not worth anyone's time. Automating the triage made it worth $23,920.

Ghost command-and-control activity in this operation runs from mid-July to live encryption on September 30. Ten weeks, 62 organizations, one shift. If your incident response plan leans on a long dwell time to give you a chance to notice, revisit the arrival rate before you revisit detection coverage.

Hunt for what the automation left behind

Automated intrusion leaves regular artefacts, which is the one gift it gives defenders. The accounts, the task names and the loader paths repeat across victims because a module generated them. Start with the administrator accounts, because those are what persist after a patch.

# 1. Are you on an affected build at all?
#    FortiClient EMS: affected 7.4.5 - 7.4.6. Read it from the server, not the ticket.
#    SimpleHelp: affected <= 5.5.7. The banner is unauthenticated.
curl -sk https://simplehelp.example.internal/allversions | head -5

# 2. Management interfaces should not answer from the internet at all.
#    Run this from outside your perimeter, not from the LAN.
for host in simplehelp.example.com ems.example.com whm.example.com; do
  printf '%s ' "$host"
  curl -sk -o /dev/null -w '%{http_code}\n' --max-time 5 "https://$host/"
done

# 3. Block the recovered infrastructure at the egress firewall and in DNS.
for ip in 45.227.254.43 45.227.254.45 45.227.254.84 179.60.149.68 \
          89.185.83.8 138.124.113.210 77.110.109.248; do
  grep -r "$ip" /var/log/ 2>/dev/null
done
for d in iquickline.com system-strategy.org mcgrawney.com bossprotect.com \
         driverupdate.app stackpathcloud.com cloud-update.live; do
  grep -ri "$d" /var/log/ 2>/dev/null
done

Then go after the host-side artefacts. Every one of these comes from SOCRadar's recovered tooling rather than from generic ransomware guidance, so they are worth running even if your EDR is quiet.

// Microsoft Defender XDR / Sentinel - advanced hunting
// a) The scheduled task the loader installs
DeviceProcessEvents
| where Timestamp > ago(120d)
| where ProcessCommandLine has_any ("RealtekAudioSvc")
     or ProcessCommandLine matches regex @"(?i)schtasks.*\/create.*Realtek"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

// b) Office spawning download utilities - the initial-access pattern
DeviceProcessEvents
| where Timestamp > ago(120d)
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe")
| where FileName in~ ("curl.exe","certutil.exe","bitsadmin.exe","mshta.exe","powershell.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

// c) The disguised loader path on any web-facing host you own
DeviceFileEvents
| where Timestamp > ago(120d)
| where FolderPath endswith @"\assets\js\analytics.js" or FolderPath has "/assets/js/analytics.js"
| where InitiatingProcessFileName !in~ ("msedge.exe","chrome.exe","firefox.exe")
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, SHA256

Three more checks that need a human, not a query. In FortiClient EMS, list every administrator account and every VPN connection profile, and compare both against a known-good export: the operators created back-door admins and edited connection scripts to push payloads, and SOCRadar reports account names in the shape of sysadmin, fct_svc_* and ems_monitor_*. On domain controllers, look for replication requests from hosts that are not domain controllers. On file and backup servers, alert on a process that opens a volume handle and then issues IOCTL 0x0053C028; the INC encryptor deletes shadow copies through direct driver calls instead of vssadmin, specifically so the command-line detection most teams rely on never fires.

Audit the admin accounts your patch will not remove

Patching closes the door. It does not evict anyone already inside, and in this operation the thing left behind was an account, not a file. Update FortiClient EMS past 7.4.6 and SimpleHelp past 5.5.7, apply your cPanel vendor's fix, then audit every administrator account on all three and every technician account your IT provider holds. Pull management interfaces off the public internet while you are in there. If you buy IT from a managed provider, send them one question in writing today: what version is your remote-support server, and when was its administrator list last reviewed. An answer that covers the version and skips the account list is not an answer.

The wider lesson is cheap to act on and uncomfortable to ignore. Every exploit in this operation was patchable on the day it was used. The budget that used to protect a small company, attacker attention being expensive and finite, has been spent. Treat your public-facing patch latency as the control that now carries the weight, and measure it.