INC and The Gentlemen: Exposed AI Agent Ransomware Infrastructure

A security vendor reported on 20 October 2026 that affiliates of the INC and The Gentlemen ransomware groups ran intrusions through an AI coding agent, and left the servers that prove it open to the internet. Their own records claim break-ins through FortiClient EMS, SimpleHelp and cPanel. Patch those three, hunt the published indicators and check your MSP's remote access.

This post covers what the exposed servers contained, how the AI agent was used (at the level a defender needs, not a playbook), every vulnerability the operators touched with its affected and fixed versions, all published indicators, step by step detection and remediation commands for each platform, and what would have helped.

One point first, and it applies to every count in this post. Almost all of the access figures come from the operators' own records, which the researchers found on the exposed servers. The report says plainly that these figures are "per operator records, not independently verified." Where we give a count of targets, admin accounts, passwords or breaches, read it as what the attackers wrote down about themselves, not as a confirmed number of victims.

What the report says

The research team found one command and control server that was publicly reachable. On it were the operators' AI session databases, a central knowledge base the AI kept about victims and progress, and the source code of a framework the operators call "Phantom", described in its own files as an "Autonomous Red Team Kill Chain Framework". Configuration files, logs and credentials on that server led the researchers to six more servers run by the same people, seven in total.

According to the report, the seven servers held:

• AI session history from an AI coding agent called OpenCode, wired to commercial language models through paid OpenRouter accounts.
• A persistent knowledge base the AI maintained across sessions, with victim notes, stolen credentials and campaign status.
• 46 custom INC encryptor builds prepared for six victims, for Windows and Linux.
• A screenshot from a remote support console dated 30 September 2026 showing an encryptor running on a victim workstation.
• A branded extortion package for a case later listed on The Gentlemen's leak site.
• A partner guide offering the tooling to other operators.

The researchers assess the operator as Russian speaking and mostly active between 06:00 and 14:00 UTC. They assess with low confidence that INC and The Gentlemen have a formal alliance, and with moderate to high confidence that both brands' work passed through one shared operational environment. Their most plausible reading is a dedicated tooling and infrastructure provider serving several ransomware partners.

The Hacker News covered the research on 23 October. INC Ransom is tracked by MITRE ATT&CK as group G1032, also known as GOLD IONIC, which MITRE describes as a ransomware and data extortion group active since at least July 2023 that mainly targets industrial, healthcare and education organisations in the US and Europe.

The numbers, as the report gives them

Every figure below comes from the vendor report. Those marked "operator record" were taken from the attackers' own logs and the report says they were not independently verified.

The report also grades how deep the operators got into each of the 62 organisations: 12 reconnaissance only, 28 at a foothold, 14 at domain level, 4 at the encryption or extortion stage and 4 publicly listed. Of the 35 organisations whose revenue could be classified, 27 had revenue of $250 million or less. Some small businesses were reached through a managed service provider (MSP). We do not name any affected organisation.

Timeline

Times are given where a primary source publishes them. Vulnerability dates come from the vendor advisories, NVD and the CISA Known Exploited Vulnerabilities (KEV) catalog, which we read from CISA's JSON feed (catalog version 2026.10.23, released 23 October 2026 at 17:00 UTC).

The gap that matters most for defenders is in the first half of that table. The SimpleHelp flaw had a fix in January 2025 and a CISA ransomware advisory in June 2025. The operators were still scanning thousands of SimpleHelp servers in 2026 and, by their own records, still finding admin passwords.

How the operation worked

The report calls the structure "AI-executed, human-approved". We describe it at the level a defender or an AI platform team needs. We do not reproduce prompts, templates or tooling.

The AI stack

The operators used OpenCode, an open source AI coding agent that runs in a terminal, as their interface. Behind it sat commercial models reached through OpenRouter, a service that routes API calls to many model providers. The vendor report lists the specific commercial model identifiers seen in the session data; we do not repeat them here because the claim rests on a single third party report. Nothing in either source says any model provider was breached. The operators bought access through paid OpenRouter accounts, and the report found two still active on 5 October.

Around the agent the operators built three things:

1. Phantom, a modular framework with 18 skill modules, an "autopilot", and its own implants that masquerade as Windows Update components. The Hacker News reports that the Phantom agent pulls tasks from an external server, runs commands and returns output. Its modules cover reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment and endpoint security fingerprinting.
2. WormGPT-MCP, a set of 32 Model Context Protocol (MCP) servers that gave the agent tools from reconnaissance through to extortion, including a ransom operations server with negotiation and pricing tools.
3. A persistent knowledge base that the AI updated across sessions with victim details, credentials and progress.

"WormGPT" was a costume, not a model

The name will draw attention, so it is worth being exact. The report says "WormGPT" here was only a persona prompt and a label on the MCP servers. The models were standard commercial models, not an uncensored criminal model. That matters for defenders: the capability came from ordinary tools anyone can buy, arranged by an operator.

Refusals were handled by rewording, not by switching models

When a model refused a request, the report says the operator did not move to a different model. Instead the request was rewritten as if it came from an authorised red team assessment. We are not going to describe the templates. The lesson for anyone building AI products is that a single refusal is a speed bump if the surrounding account, billing and usage signals do not also flag the pattern.

A human approved every step

Each campaign began with a victim-specific master prompt, and the AI then waited for the operator's approval before each action under a standing instruction to "coordinate every action with me". So this was not an autonomous agent let loose. It was a human operator using an agent to go faster: drafting commands, debugging tools, tracking dozens of victims in parallel and suggesting stealth choices, with a person pressing approve.

That detail cuts both ways. It means the familiar human approval loop that responsible teams use for their own agents is not a safety control by itself. Approval protects you from your agent doing something you did not intend. It does nothing when the person approving is the attacker.

The AI's memory became the evidence

The report notes that knowledge bases and session logs form "a full evidence trail". Every target, every credential tried, every decision and every failed exploit was written down by the AI for its own later use. Once the server was exposed, that record was readable by researchers. For defenders, the practical takeaway is that the same is true of your own agents: whatever your AI tools remember, an attacker who reaches that store can read too.

How they got in: the vulnerabilities

The operators' main way in was exploiting public facing edge and remote access systems at scale, then using stolen credentials. The table lists every CVE the report associates with the operation, the outcome the report gives, and whether CISA lists it as known exploited.

"Not fetched" means we did not read a scoring source for that CVE for this post, not that no score exists. The report also lists CVE-2025-62215 as developed with use not established; CISA's catalog describes it as a Windows race condition added on 12 November 2025.

Two patterns stand out. First, the three entry points that the operators recorded as working (FortiClient EMS, SimpleHelp and cPanel) are all management planes: each one controls many other machines. Second, the list includes two AI and web components that live inside ordinary application stacks, LiteLLM and WordPress or Drupal, which sit in the repositories and images that teams build themselves.

Technical details

Everything in this section was read in a fetched primary source and is attributed. Indicators are defanged as published. Defensive use only.

Affected and fixed versions

Notes from the advisories: Palo Alto Networks says CVE-2026-0300 does not affect Prisma Access, Cloud NGFW or Panorama, and lists Threat Prevention Threat ID 510019 with content version 9097-10022 or later (decoder support needs PAN-OS 11.1 or later). Drupal says its SQL injection only affects sites on PostgreSQL, while the bundled Symfony and Twig updates apply to all sites. Fortinet's advisory lists no workaround other than the hotfix or upgrade.

Network infrastructure

All seven servers, as published. The report says most sit in AS267784 (Flyservers S.A.).

Domains

The report also lists a look-alike notice domain used against one victim, which we omit because it carries that organisation's name.

Onion services

File hashes (SHA-256)

Each of the 46 builds carries its own key and victim ID, so the report's hashes will not match every sample. Treat them as confirmation for a hit, not as a complete list. The report says an extended indicator list is available on its platform and in a whitepaper.

Host artefacts and behaviours

From the report's detection and hunting guidance and tool descriptions:

• Ransom note and extension: INC-README.txt, files renamed with .INC. The note points to a Tor chat portal.
• Shadow copy deletion: done through direct driver calls rather than vssadmin, so rules that only watch vssadmin will miss it. The report lists opens of \\.\X: volume handles followed by IOCTL 0x53C028, and Restart Manager use from non-installer processes.
• Service stops: the Windows variant stops backup and database processes and services before encrypting.
• Persistence: a scheduled task named RealtekAudioSvc (used by the phishing service); implants named to look like Realtek, Windows Update or WUServiceHost components; a Python script svc.py.
• Loader path: /assets/js/analytics.js, a disguised loader.
• Defence impairment: a bring your own vulnerable driver (BYOVD) killer that loads the signed anti-malware driver zam64.sys to terminate one endpoint protection product's services and delete its files. The report names the targeted product. Operator logs record "mixed results" against enterprise endpoint tools.
• Tunnelling and C2: RevSocks reverse SOCKS5; the report also tells defenders to look for Chisel and Ligolo patterns, Python beacons with TLS verification disabled, and mutual TLS panel URIs. Ghost C2 has three generations of polymorphic implants that talk over HTTPS through a CDN, Telegram or DNS. QuickLine is a CDN fronted agent for the open source Mythic framework (the Athena agent).
• Exfiltration: tools named rks3 and BackupConsole or BackupAgent, with restic and rclone use noted.
• FortiClient EMS backdoor accounts: new privileged accounts named sysadmin, fct_svc_* or ems_monitor_*; changed VPN profiles and connection scripts; missing audit logs; forged client certificate headers.
• Active Directory: replication requests from machines that are not domain controllers, reads of shadow-copied ntds.dit, spikes in RC4 Kerberos tickets, Netlogon anomalies.
• Lateral movement: unauthorised RMM agents; the Remote Registry service started before RDP is enabled.
• Initial access by phishing: Office loading a remote .dotm template; curl or certutil started by Office or a browser; HTML smuggling. The report says the phishing service's only recorded campaign was an internal self-test.

ATT&CK mapping (as published)

The report maps the activity to, among others: T1190 Exploit Public-Facing Application, T1133 External Remote Services, T1078 Valid Accounts, T1072 Software Deployment Tools, T1136 Create Account, T1053.005 Scheduled Task, T1003.003 and T1003.006 (NTDS and DCSync), T1558.003 Kerberoasting, T1210 Exploitation of Remote Services, T1219 Remote Access Software, T1572 Protocol Tunneling, T1567.002 Exfiltration to Cloud Storage, T1486 Data Encrypted for Impact, T1489 Service Stop, T1490 Inhibit System Recovery and T1657 Financial Theft.

Who is exposed

Detection: step by step

Work through these in order. Each step is read only.

1. Search network and DNS logs for the published indicators

Put the IPs and domains from the tables above into a file (refanged) and search your firewall, proxy and DNS logs. On a Linux log host:

cat > /tmp/inc-iocs.txt <<'EOF'
45.227.254.43
45.227.254.45
45.227.254.84
179.60.149.68
89.185.83.8
138.124.113.210
77.110.109.248
system-strategy.org
iquickline.com
mcgrawney.com
driverupdate.app
stackpathcloud.com
cloud-update.live
bossprotect.com
incblog.su
EOF
grep -rFi -f /tmp/inc-iocs.txt /var/log/firewall/ /var/log/proxy/ /var/log/dns/ 2>/dev/null | head -100

Adjust the paths for your SIEM or log store. A hit on an IP from AS267784 is worth checking against the whole range, not only the listed addresses.

2. Check FortiClient EMS

Confirm the version in the EMS console (Dashboard, Status), or on the EMS server:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
  HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object DisplayName -like "*FortiClient*EMS*" |
  Select-Object DisplayName, DisplayVersion

If it reports 7.4.5 or 7.4.6 without the hotfix, assume exposure. Then, in the console, list administrators and look for any account you did not create, especially names matching sysadmin, fct_svc_* or ems_monitor_*. Review every VPN profile and any script attached to VPN connection events, and compare against your change records. Missing audit log periods are themselves an indicator, according to the report.

3. Check SimpleHelp servers and endpoints

CISA's advisory AA25-163A gives two ways to read the server version. On the server (adjust the path to your install location):

head -5 /opt/SimpleHelp/configuration/serverconfig.xml

Or from a machine allowed to reach it, request the version page:

curl -s https://your-simplehelp-host/allversions | head -40

Anything at 5.5.7 or below without Patch 070125 is vulnerable. On endpoints, CISA lists where the Remote Access service lives:

• Windows: %APPDATA%\JWrapper-Remote Access
• Linux: /opt/JWrapper-Remote Access
• macOS: /Library/Application Support/JWrapper-Remote Access

Open JWAppsSharedConfig/serviceconfig.xml and read lines starting with ConnectTo to see which servers each endpoint trusts:

grep -i "ConnectTo" "/opt/JWrapper-Remote Access/JWAppsSharedConfig/serviceconfig.xml"

An unfamiliar server address there means someone else can control that machine. CISA also suggests hunting for executables with three letter alphabetic names (such as aaa.exe) created after January 2025.

4. Check cPanel and WHM

On each server:

/usr/local/cpanel/cpanel -V

Compare with the fixed builds in the version table. A published research analysis of CVE-2026-41940 points defenders at the session store: review /var/cpanel/sessions/raw/, /var/cpanel/sessions/cache/ and /var/cpanel/sessions/preauth/ for sessions with unexpected top level keys. A quick first pass:

grep -lE "^(hasroot|tfa_verified|successful_internal_auth_with_timestamp)=" /var/cpanel/sessions/raw/* 2>/dev/null

Legitimate sessions can carry some of these keys, so treat a match as a lead to review with login logs, not as proof.

5. Check PAN-OS and SonicWall SMA1000

On PAN-OS, run show system info and compare sw-version with the fixed hotfix for your branch. Check whether Response Pages are enabled in any Interface Management Profile on an interface that faces untrusted traffic, and whether Threat ID 510019 is active. For SMA1000, read the firmware version in the appliance management console and compare with SNWLID-2026-0008.

6. Hunt on Windows hosts

Look for the vulnerable driver, the scheduled task and the ransom note:

# Driver present or loaded
Get-CimInstance Win32_SystemDriver | Where-Object { $_.PathName -match 'zam64' } |
  Select-Object Name, State, PathName
Get-ChildItem -Path C:\ -Filter zam64.sys -Recurse -ErrorAction SilentlyContinue

# Scheduled task named in the report
Get-ScheduledTask -TaskName "RealtekAudioSvc" -ErrorAction SilentlyContinue |
  Select-Object TaskName, TaskPath, State, Actions

# Ransom note and extension
Get-ChildItem -Path C:\ -Include INC-README.txt -Recurse -ErrorAction SilentlyContinue |
  Select-Object FullName, CreationTime

# Hash check for a suspicious file
Get-FileHash -Algorithm SHA256 C:\path\to\suspect.exe

If you run Sysmon, driver loads appear as event ID 6; filter on zam64.sys and correlate with your endpoint protection service stopping. Look for restic.exe, rclone.exe, rks3 or BackupAgent running on machines that are not backup servers.

7. Check domain controllers

For ZeroLogon, confirm enforcement and look for denied or allowed vulnerable connections. Microsoft's guidance says enforcement mode has been on by default since 9 February 2021, and the registry value lives here:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name FullSecureChannelProtection -ErrorAction SilentlyContinue

Get-WinEvent -FilterHashtable @{LogName='System'; Id=5827,5828,5830,5831} -MaxEvents 50 -ErrorAction SilentlyContinue

Event 5827 or 5828 means a vulnerable connection was denied (someone tried). Events 5830 and 5831 mean one was allowed by the group policy "Domain controller: Allow vulnerable Netlogon secure channel connections", which Microsoft describes as a temporary measure. For CVE-2026-41089, check the OS build against the fixed builds in the version table:

(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").UBR

8. Check the application components you build

These ones sit in your own repositories and container images:

pip show litellm 2>/dev/null | grep -i ^version     # fixed in 1.83.7
wp core version --allow-root 2>/dev/null            # fixed in 6.9.5 and 7.0.2
drush status --field=drupal-version 2>/dev/null     # see fixed list above

For a fleet, scan the images rather than logging into each host. The section on Safeguard below shows how.

Remediation: step by step for each platform

FortiClient EMS

1. Apply the hotfix for 7.4.5 or 7.4.6 from the release notes, or upgrade to 7.4.7 or later.
2. Remove any EMS administrator you cannot account for, then reset every remaining EMS admin password.
3. Restore VPN profiles and connection scripts from a known good copy, then push to endpoints.
4. Treat every endpoint that received a changed VPN script as possibly compromised and investigate it.
5. Take the EMS management interface off the internet. The report recommends removing internet exposure of management interfaces for Fortinet and SonicWall devices.

SimpleHelp

1. Upgrade to 5.5.8 or later, or apply Patch 070125 on 5.4.10 or 5.3.9. If you cannot, CISA says to isolate the server from the internet or stop the server process.
2. Change the administrator password. SimpleHelp suggests disabling the built-in SimpleHelpAdmin user and using a separate Administrator Technician account.
3. Change all technician passwords, and move technician logins to your directory (Active Directory or LDAP) rather than local accounts.
4. Restrict which IP addresses can log in as Technician or Administrator, which clients can call the API, and which addresses the firewall lets reach the server.
5. Issue new API tokens if you use them.
6. Turn on Server Event alerts for administrator logins, failed logins and configuration changes.
7. If you are a vendor or MSP, tell your downstream customers, as CISA advises.

cPanel and WHM

1. Update to a fixed build (/scripts/upcp on a standard install) and confirm with /usr/local/cpanel/cpanel -V.
2. Invalidate active sessions after updating, then review the session directories above.
3. Rotate root, reseller and WHM API tokens, and review accounts created recently.
4. Because the operators claimed to pivot to hosted webmail, review mail forwarding rules and recent webmail logins for hosted domains, and keep Roundcube current.

PAN-OS

1. Upgrade to the fixed hotfix for your branch.
2. Until then, restrict the User-ID Authentication Portal to trusted zones and disable Response Pages on interfaces where untrusted traffic can enter, as Palo Alto Networks advises, or turn the portal off if you do not use it.
3. Enable Threat ID 510019 on content version 9097-10022 or later.

SonicWall SMA1000

1. Apply the fixed firmware listed in SNWLID-2026-0008.
2. Keep the management interface off the internet and review appliance logs for unexpected outbound requests.

Windows domain and endpoints

1. Patch domain controllers for CVE-2026-41089 and confirm ZeroLogon enforcement. The report recommends retiring Windows Server 2008 R2 domain controllers.
2. Deploy LAPS for local administrator passwords and group managed service accounts for services, as the report recommends, and separate admin accounts by tier.
3. Turn on the Microsoft vulnerable driver blocklist. Microsoft says it has been on by default since the Windows 11 2022 update and is enforced when memory integrity (HVCI), Smart App Control or S mode is active. It can be checked in Windows Security under Device security, Core isolation. Microsoft also recommends the attack surface reduction rule "Block abuse of exploited vulnerable signed drivers", which stops a vulnerable driver being written to disk, while the blocklist stops one already present from loading. Microsoft notes the in-box list can lag its downloadable list, which you can deploy through App Control for Business after testing in audit mode.
4. Turn on tamper protection in your endpoint tool and alert when a security service stops.
5. Restrict restic and rclone to the machines that are meant to run them.

LiteLLM, WordPress and Drupal

1. LiteLLM: upgrade to 1.83.7 or later and rotate the provider keys and virtual keys the proxy stores, since the flaw could expose its database.
2. WordPress: update to 6.9.5 or 7.0.2 or later.
3. Drupal: update to the fixed release for your branch; on 8.9 or 9, apply the patch and plan a migration.

Backups

The report recommends immutable or air gapped backups and isolating and patching backup consoles. One reused password, it says, unlocked VPN, servers, RMM, backup and security management in a single case. Backup administration should not share credentials with anything else.

If you find a match

1. Isolate the affected host or appliance from the network, but do not power it off if you want memory for forensics.
2. Preserve logs from the management plane (EMS, SimpleHelp, WHM) before you patch, because patching and restarting can rotate them.
3. Rotate every credential the compromised system could reach, starting with domain admin, RMM technician, backup and VPN accounts.
4. Check backups for tampering before you rely on them.
5. If you are an MSP, tell your clients. If you are a client, ask your MSP.
6. Report ransomware incidents. CISA advises US victims to contact a local FBI field office, IC3 or CISA, and says CISA and the FBI do not encourage paying ransoms.
7. Prepare for the extortion pattern the report describes: text-only emails to owners and executives with no price, masked samples of stolen data, scripted phone calls, then threats to tell customers, partners and regulators, with deadlines of 24 to 72 hours. Have legal and notification templates ready before you need them.

The AI agent angle: what this means for your own agents

Most coverage will focus on attackers using AI. For defenders who also run AI agents, the more useful view is the mirror image. The operators built exactly the stack many engineering teams are building: a terminal coding agent, a model router, a set of MCP servers for tools, and a memory store. Four lessons carry over.

Your agent's memory is a target. The operators' knowledge base held every credential they stole. Your agents' memory and session logs may hold secrets, customer data and internal hostnames. Decide what an agent is allowed to remember, where that store lives, who can read it, and how long it is kept.

MCP servers are privileged services. The 32 MCP servers here each gave the model a capability. In your environment, each MCP server is a service account with an API on top. Inventory them, require authentication, and give each the narrowest scope that works. Our post on the Skynet LLMjacking agent covers exposed MCP servers in more depth.

Approval settings are configuration, not a guarantee. OpenCode's documentation says most of its permissions default to "allow", with only access outside the project directory and repeated identical tool calls defaulting to "ask", and that its auto mode approves requests that would otherwise prompt. Explicit "deny" rules still apply. If your developers use any coding agent, set a policy: ask before shell commands, deny destructive commands, and ask before reading .env files. Then remember this incident's operator approved every step and it did not slow them down. Approval protects against your agent going wrong, not against a malicious person at the keyboard.

AI gateways are in scope. LiteLLM, a common AI gateway, appears in the operators' exploit list. A gateway holds every provider key your organisation uses. Patch it like an internet facing service and keep its admin interface private. For key handling, see what LLMjacking is and how to protect AI API keys. India's CERT-In has also published guidance on attack vectors against AI agents that maps well to these controls.

What changed since first reports

• The vendor report was updated on 23 October, three days after first publication. We read the updated version.
• The spend figure appears twice in the report with different values: "exceeds $23,000" in the introduction and $23,920 in the key takeaways and funding section. Both are operator recorded.
• The partner guide on one server advertises "35 MCP servers", "55+ tools" and "9K+ CVE PoC". The recovered source shows 32 MCP servers. Treat the advertised numbers as marketing by criminals.
• The Hacker News reports that the US accounts for more than 50% of targets; the report's own figure is 36 of 62 named organisations, about 58%.
• The Hacker News does not name the AI models. The vendor report names two model identifiers from the session data.
• Separately, a research team reported on 21 October that organisations hit by an access broker abusing FortiWeb and PAN-OS were later listed by Qilin and The Gentlemen, and said that link was unconfirmed. We covered it in the edge access broker campaign. Nothing we read connects that broker to the infrastructure in this report, and we do not connect them.

Open questions

• Were the 46 staged builds deployed? The report shows live encryption on 30 September through one screenshot, and says deployment against the staged targets is unconfirmed.
• How accurate are the operators' own counts? The report says they are not independently verified. Attackers have reasons to inflate figures, especially in material aimed at recruiting partners.
• Was any ransom paid? No Monero wallet or payment record was recovered, and the outcomes of the demands are unknown.
• Who else used the tooling? The partner guide suggests the infrastructure was offered to other operators. The report's best reading is a tooling provider serving several ransomware partners.
• Did the exposed servers go dark? The live check on 5 October found two paid model accounts still active. Neither source says whether the servers or accounts have since been taken down.
• How did the BYOVD killer fare? Operator logs say "mixed results" against enterprise endpoint tools. We do not know which ones held.

What would have helped

None of the entry points the operators recorded as working was a zero-day when they used it. FortiClient EMS, SimpleHelp and cPanel each had a fix and a KEV listing before the operation's timeline began in mid July 2026. SimpleHelp's fix was 18 months old. That makes this an inventory and patch speed story first.

Practices any team can use

1. Know every management plane you expose. EMS servers, RMM consoles, hosting panels, VPN portals and firewall management interfaces each control many machines. Keep a list with an owner and a version for each, and check it against KEV weekly.
2. Patch KEV entries on management planes within days. CISA's KEV due dates for these entries were three days after listing for most 2026 additions. That is a sensible internal target for anything that administers other systems.
3. Never expose a management interface directly. Put EMS, RMM, WHM and appliance admin pages behind a VPN or an IP allowlist. The report and CISA both say this.
4. Hold your MSP to the same standard. Ask which RMM tools and versions they run, whether technician logins need MFA, whether logins are restricted by IP, and how quickly they patch. The report recommends requiring this of third party MSPs.
5. End password reuse across tiers. One reused password unlocking VPN, servers, RMM, backup and security tools is the report's clearest example. Separate accounts for each tier, a password manager and LAPS fix most of it.
6. Block vulnerable drivers. Turn on the Microsoft vulnerable driver blocklist and the matching attack surface reduction rule, and alert when a security service stops.
7. Make backups survive an admin compromise. Immutable or offline copies, a backup console on its own network and credentials, and a restore test on a schedule.
8. Govern your own AI agents. Inventory agents, MCP servers and gateways; set permission policies; decide what agent memory may hold; patch gateways like any internet facing service.
9. Rehearse extortion response. Retain incident response help, prepare notification templates and agree in advance who speaks to whom.

Where Safeguard fits

Most of the entry points in this story are vendor appliances and commercial products: FortiClient EMS, SimpleHelp, cPanel and WHM, PAN-OS, SonicWall and Windows Server. Safeguard does not patch those, does not scan the internet for your exposed management interfaces and does not run on your domain controllers. The fixes there come from the vendors, and the controls are network placement, credentials and endpoint tooling. Safeguard would not have prevented this campaign.

Where Safeguard helps is the software you build and ship, which includes several components on the operators' list:

• Knowing what you run. SBOM and dependency scanning of repositories, container images and SBOM files: safeguard scan --dir ., safeguard scan --image <name> and safeguard scan --sbom <file>, with JSON results under ./output. The platform shows which projects contain a given component and version, so finding every image that ships LiteLLM below 1.83.7, or a WordPress or Drupal build in the affected ranges, is a query rather than a survey. If a supplier gives you an SBOM for a product you run, you can scan that file the same way.
• Prioritising. Vulnerability matching against vulnerability databases, with reachability analysis to rank the vulnerable code paths your application actually calls.
• Stopping regressions. Policies and gates evaluated in the platform, so a version you removed does not come back in a later merge.
• Fixing with approval. Autonomous remediation opens fix pull requests and ships switched off, with every category set to Manual. The Safeguard CLI's assistant can edit code and run commands with your approval, and /permissions lets a team choose between Ask, Accept edits, Plan, Auto (the default) and Strict. safeguard exec runs it in CI. The desktop and phone apps can send work to a computer running the CLI and approve each command.

That last point connects to the AI angle. The operators used an agent with a human approving each step. Safeguard's assistant uses the same pattern for the opposite purpose, and the lesson from this incident applies to it as to any agent: the approval is only as good as the person giving it and the permissions you set.

Zero-Day Discovery and Gold

The entry points here were known, listed vulnerabilities with vendor fixes, most of them in commercial products and operating systems that sit outside the package ecosystems Zero-Day Discovery covers. Zero-Day Discovery looks for previously unknown flaws before a CVE exists, in an agentic mode and a deterministic scanner mode, issues findings as SGZ advisories before they reach public CVE databases, and covers seven package ecosystems. We make no claim that it found any vulnerability in this story or that an SGZ advisory existed for one.

Gold is relevant to the open source components on the list. Gold Open Source shows known CVEs with CVSS, EPSS, KEV status, affected and fixed versions and a recommended safe version, free and without login. Gold Registry supplies hardened, signed components and images held to zero exploitable critical or high CVEs, with SLSA L3 or higher provenance. We do not claim Gold holds a specific fixed build for any CVE here. The habit that matters is the one this incident punishes: pull patched, signed components from a curated source and rebuild fast.

Common mistakes

• Patching the appliance and stopping there. FortiClient EMS backdoor admins and changed VPN scripts survive a patch. SimpleHelp password hashes that already left survive a patch. Audit and rotate after you update.
• Treating the published hashes as complete. Each of the 46 builds has its own key and victim ID. A clean hash search does not clear you.
• Watching only vssadmin. The Windows encryptor deletes shadow copies through direct driver calls.
• Assuming your MSP is patched. The SimpleHelp numbers in the operators' records are about MSPs and their clients. Ask.
• Quoting the operators' numbers as fact. They are the attackers' own records. If you brief leadership, say so.
• Thinking an AI model refusal is a control. The report says refusals were handled by rewording. Your controls have to be patching, credentials and network placement.
• Leaving coding agents on default permissions. OpenCode documents most permissions as "allow" by default. Check what your developers' agents are allowed to do.
• Blocking only the seven IPs. Most of the infrastructure sits in one autonomous system; watch for neighbours.

FAQ

What did researchers find on the INC and The Gentlemen servers?

A security vendor found one exposed command and control server holding AI session databases, an AI maintained knowledge base, and the source of a framework called Phantom. It led to six more servers with 46 INC encryptor builds, a screenshot of live encryption on 30 September 2026, and an extortion package for a case listed by The Gentlemen.

Did AI run these attacks on its own?

No. The report describes an "AI-executed, human-approved" structure. A Russian speaking operator wrote a master prompt per victim, and the agent waited for approval before each action. The AI made the operator faster and better organised; it did not act alone.

Which AI tools and models were involved?

OpenCode, an open source terminal coding agent, connected to commercial models through paid OpenRouter accounts. The vendor report lists specific commercial model identifiers, which we do not repeat; The Hacker News does not name models. "WormGPT" was only a persona prompt and a label on 32 MCP servers. Neither source says any AI provider was breached.

Which vulnerabilities should I patch first?

FortiClient EMS CVE-2026-35616 (7.4.5 and 7.4.6; hotfix or 7.4.7), SimpleHelp CVE-2024-57727 (5.5.8 or the 070125 patch) and cPanel and WHM CVE-2026-41940. The operators recorded success with these three; those counts are their own and not independently verified. Then PAN-OS CVE-2026-0300 and SonicWall SMA1000 CVE-2026-15409, both in KEV.

How many organisations were affected?

The report names 62 organisations, 36 in the United States, with four publicly listed on a leak site. Access counts such as 108 FortiClient EMS admin accounts or 427 SimpleHelp admin passwords come from the operators' own records and are not independently verified.

Are INC and The Gentlemen working together?

The researchers rate a formal alliance as low confidence. They rate a shared operational environment used across both brands as moderate to high confidence, and think the most plausible explanation is a tooling and infrastructure provider serving several ransomware partners.

I am an MSP customer. What should I ask my provider?

Which remote management tools and versions they run, whether SimpleHelp is at 5.5.8 or later, whether technician logins require MFA and are restricted by IP, whether technician and admin passwords were rotated after patching, and how quickly they apply KEV fixes.

How can I tell if the BYOVD killer was used on my machines?

Look for zam64.sys on disk or loaded as a driver (Sysmon event ID 6), close in time to your endpoint protection service stopping or its files being deleted. Turn on the Microsoft vulnerable driver blocklist so the driver cannot load.

What does this mean for teams building with AI agents?

Treat agent memory, MCP servers and AI gateways as sensitive systems. Restrict what agents may remember and run, authenticate every MCP server, and patch gateways such as LiteLLM, which appears in the operators' exploit list. Approval prompts help against mistakes, not against a malicious operator.

Would Safeguard have stopped this?

No. The main entry points were vendor appliances and remote management products that Safeguard does not patch or monitor. Safeguard helps with the open source components you build, such as LiteLLM, WordPress and Drupal: finding where vulnerable versions live, gating them out and opening fix pull requests with approval.

Fix it without waiting for upstream

Most of the products in this story are commercial, so their fixes come from the vendor. The open source pieces on the operators' list, such as LiteLLM, WordPress and Drupal, are where your own pipeline decides how fast the fix ships.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would have helped

These are real product sessions on other examples. None of them shows this campaign, its infrastructure or any victim.

The CLI demo shows the assistant fixing a lodash CVE: it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs install and tests with your approval, prints a summary and pushes nothing. Here, you would run safeguard scan --image against the image that runs your AI gateway and ask the assistant to move LiteLLM to 1.83.7. Every command waits for you, which is the approval pattern this post recommends for any agent.

Click through it at your own pace, or open it full screen.

The desktop app demo shows a CLI session in the conversation list, a folder choice, and Approve or Deny on each command and file edit, ending with the upgrade done and tests passing. For this incident, you would pick the repository for a WordPress or Drupal site, ask for the core update to a fixed release, and approve each change yourself.

Click through it at your own pace, or open it full screen.

The mobile demo shows a real Android session sending work to a computer running the CLI and approving a command on the phone with Allow once, Allow for turn or Deny. When a KEV listing lands out of hours, as several of these did, that is how an on-call engineer can start the upgrade and still approve every step.

Click through it at your own pace, or open it full screen.

To try it on your own systems, download Safeguard and read the CLI documentation. For related reading, see the edge access broker campaign, edge device zero-days in October 2026, IDCF Cloud ransomware and third party risk and October 2026 security incidents and what would have helped.

Quick check

Sources

• Security vendor report: INC and The Gentlemen ransomware AI infrastructure (20 Oct 2026, updated 23 Oct) (primary)
• The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
• MITRE ATT&CK: INC Ransom, G1032
• CISA Known Exploited Vulnerabilities catalog (JSON feed, version 2026.10.23)
• CISA AA25-163A: Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management
• Fortinet PSIRT FG-IR-26-099: FortiClient EMS API authentication and authorization bypass
• SimpleHelp: Security vulnerabilities 01-2025
• Palo Alto Networks: CVE-2026-0300
• Drupal SA-CORE-2026-004
• NVD: CVE-2026-35616
• NVD: CVE-2024-57727
• NVD: CVE-2026-41940
• NVD: CVE-2026-0300
• NVD: CVE-2026-15409
• NVD: CVE-2026-41089
• NVD: CVE-2026-63030
• NVD: CVE-2026-42208
• NVD: CVE-2026-9082
• Research analysis of CVE-2026-41940 with fixed builds and session artefacts
• Microsoft: Recommended driver block rules
• Microsoft: How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472
• OpenCode documentation: Permissions

Last reviewed: 24 October 2026. This is a developing story; check the linked advisories for the latest status.