Attackers leave their servers open too. SOCRadar found those of affiliates of two ransomware groups with the full history of their conversations with AI models: 8,257 messages showing, step by step, how an intrusion is delegated to an agent while a human approves every action. It's a rare reference for what agent-assisted ransomware looks like in practice.
What SOCRadar Found
In an October 20, 2026 report (covered by Hackread on the 21st and The Hacker News on the 23rd), SOCRadar's research unit described seven exposed servers linked to affiliates of the INC and The Gentlemen ransomware groups. Inside were OpenCode session logs, an AI coding interface the operators combined with persistent knowledge bases on victims, stolen credentials and campaign progress.
Hackread reports that the commercial models used were Claude Opus 4.6 and Kimi K3; The Hacker News describes the use of commercial models hosted on OpenRouter. The two sources agree on the essentials but not on that detail, so we treat it as approximate.
How the “AI Executes, Human Approves” Model Works
This isn't autonomous ransomware. A human writes a victim-specific prompt and reviews each step; in one message, an instruction asked the agent to "coordinate every action with me." The logs show that when a model refused a malicious task, the operator didn't switch models: they rephrased the request as an "Authorized red team network assessment request." The Hacker News adds that the core framework, Phantom, has 18 skill modules (reconnaissance, reverse engineering, exploit research, EDR identification) and that a set of 32 MCP servers labeled WormGPT connects the AI to tools; that detail comes from a single source.
How They Got In: Edge Vulnerabilities and Credential Reuse
Initial access didn't depend on exotic AI but on known flaws in exposed systems. According to the attackers' logs, which haven't been independently verified:
THN then describes a classic cycle: enumerate the domain, escalate to administrator, harvest credentials, prioritize finance, HR, legal and executive files, and exfiltrate through reverse SOCKS tunnels. Password reuse was the multiplier: in one case, a single password gave access to VPN, servers, RMM, backups and security platforms. The extortion leans on stolen financial data and threats to notify customers, partners and regulators.
What Changes and What Doesn't
AI here speeds up work (preparing 46 encryptors, analyzing credentials, drafting reports), but the attack surface is the same as ever: unpatched VPN, remote management and hosting panels. The operators' own logs showed mixed results against enterprise EDR, according to THN. That attackers spent more than US$23,000 on AI APIs also indicates the cost is marginal compared to what they aim to collect.