inc

Oct 22 – October 25, 2026 · 2 reports

• SOCRadar mapped an exposed AI intrusion ecosystem used by INC and The Gentlemen ransomware affiliates. The framework, called Phantom, runs on OpenCode with OpenRouter-hosted commercial models under an "AI-executed, human-approved" structure: a human supplies a victim-specific prompt and reviews each step. An open directory at 45.227.254.43 logged 8,257 messages across 133 sessions. When models refused a request, the operator rewrote it as an authorised red-team assessment rather than switching models. Exploitation records name CVE-2024-57727 (SimpleHelp), CVE-2026-35616 (FortiClient EMS), and CVE-2026-41940 (cPanel/WHM) as actively exploited, with SonicWall, WordPress, LiteLLM and Drupal bugs staged or developed. In one case a single reused password unlocked VPN, servers, RMM, backup and security management platforms at once. (The Hacker News) · Oct 25 · observed · as the gentlemen · Threat Activity
• Exposed operator environments also tie AI to ransomware affiliates and lower-skill cybercrime. SOCRadar says seven servers linked to INC and The Gentlemen contained 8,257 messages across 133 OpenCode sessions, covering 62 targeted organizations and more than $23,920 in AI-service spending; targets are not confirmed breaches. Separately, Unit 42 says BUGSTER ran Hermes Agent with DeepSeek V4 safety controls disabled and confirmed exfiltration of more than 5,200 student PII records from a second Indian university. Both describe AI-assisted operations, not hands-off autonomy. · Oct 22 · observed · via ai agent · as the gentlemen, bugster · Cloud, Identity & Threat Activity

Oct 12 – October 21, 2026

• Qilin and INC ransomware operators continue exploiting PAN-OS CVE-2026-0257. The May-patched authentication bypass lets attackers establish unauthorized GlobalProtect VPN sessions and bypass MFA. Observed follow-on activity includes RMM-based reconnaissance, RDP and SMB lateral movement, and direct pivots into vCenter/ESXi; in one case, operators disabled execInstalledOnly and dumped domain credentials offline from a domain controller’s VMDK, evading in-guest EDR controls, according to The Hacker News. · Oct 21 · observed · via exposed service · as qilin · Vulnerabilities & Exploits

October 8, 2026

• FortiBleed now has a number attached: 86,644 harvested Fortinet device credentials across 194 countries. The FBI/USSS advisory adds that victims may find themselves locked out when operators disable accounts or change passwords, that attackers create new firewall accounts for persistence, and that access is being handed to initial-access brokers and affiliates of INC/Lynx and Payload ransomware. The operation became visible after the crew exposed its own backend server (The Record). (earlier coverage) · Oct 8 · observed · as lynx, payload · Threat Activity

Jun 17 – July 11, 2026

• Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen · Jul 11 · none · as qilin, the gentlemen, akira, dragonforce · Threat Intelligence

Jun 19 – June 21, 2026 · 2 reports

• INC has grown into one of 2026's most prolific RaaS operations with 830+ victims since August 2023, absorbing affiliates after the LockBit and BlackCat disruptions (The Hacker News). Current leaderboard tracking puts Qilin at 651 attacks, The Gentlemen at 430, and Akira at 282 (DarkFeed). · Jun 21 · observed · as qilin, the gentlemen, akira · Ransomware & EDR Evasion
• INC ransomware has grown into a top-tier RaaS with 830+ victims since August 2023, capitalizing on the LockBit/BlackCat collapse and leaning on healthcare for payment pressure (The Hacker News, Dark Reading). · Jun 19 · observed · Ransomware