AI as the Co-Operator: Inside INC and The Gentlemen Ransomware Operations

SOCRadar Threat Research uncovered how affiliates of INC Ransom and The Gentlemen integrate commercial AI into their offensive operations.

Exposed AI session logs, source code, and infrastructure revealed seven adversary-controlled servers, 62 targeted organizations, and more than $23,920 in AI service spending.

The research explores how operators used commercial LLMs to support attacks while retaining human approval over individual steps. Key findings include:

• Phantom, an autonomous red-team framework with 18 skill modules, alongside Ghost C2 and RevSocks
• 46 INC ransomware encryptor binaries prepared for six victims
• Extortion procedures, scripted vishing, and exploitation activity targeting enterprise infrastructure

The evidence suggests a shared operating environment across INC and The Gentlemen affiliates, though a formal alliance remains unconfirmed.

➡️ Download the full research report for technical findings, AI-assisted attack workflows, and defensive insights.