Threat feed

INC / The Gentlemen affiliates run intrusions through an AI agent (OpenCode + Phantom framework), with a human approving each step

Posted · Updated · Spectrum Delta Research Team

Summary

SOCRadar (Oct 20, updated Oct 22) recovered 7 exposed affiliate servers: 133 AI sessions, 62 named victims (36 in the US) and 46 INC encryptor builds staged for Oct 1. The AI is invisible in victim logs; what a SOC can catch is the tradecraft it drove: rogue FortiClient EMS admins and edited VPN scripts, RMM-pushed payloads, a Zemana driver AV-killer and INC encryption. Victim counts and exploitation numbers come from the operators' own records and are unverified.

Breakdown

Adversary

Affiliates working with INC Ransomware

Procedures (7)

  1. Backdoor super-admin accounts created on EMS

    • T1136Create Account
    • T1190Exploit Public-Facing Application

    Logs

    EMS admin-account audit events; absence of audit logs is itself a SOCRadar hunt item (missing audit logs and forged client-certificate headers).

Click to expand remaining (6) procedures

  1. VPN profile on_connect script edited to push payloads to managed endpoints

    • T1072Software Deployment Tools
    • T1543Create or Modify System Process

    Logs

    EMS configuration change history for VPN profiles; endpoint process creation spawned by the FortiClient service.

  2. Unauthorized RMM agents, scripts or remote sessions, and RMM-pushed encryptor deployment

    • T1219Remote Access Tools
    • T1072Software Deployment Tools

    Logs

    RMM audit logs for new scripts, agent installs or sessions outside change windows; EDR process creation from the RMM agent.

  3. Scheduled task RealtekAudioSvc for svc.py

    Logs

    Security 4698 or Sysmon task creation; Python spawned by the task.

  4. Zemana driver loaded to kill Quick Heal / Seqrite security services

    • T1562.001
    • T1068Exploitation for Privilege Escalation

    Logs

    Sysmon 6 / EDR driver load for a Zemana-signed driver from an unexpected path, paired with security-service stop or file deletion.

  5. restic or rclone bulk upload to object storage

    • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Logs

    Process creation for restic/rclone on a non-admin endpoint; proxy logs for large uploads to cloud storage.

  6. INC encryptor: mass .INC rename and INC-README.txt drop

    • T1486Data Encrypted for Impact
    • T1490Inhibit System Recovery

    Logs

    File rename/create events (mass .INC, INC-README.txt); EDR for the IOCTL. vssadmin/wmic alerts will not fire.

Indicators of compromise

Hunt only rotating infrastructure assessed 2026 10 22 — ips

45.227.254.43 (AI node, knowledge base, Phantom source), 45.227.254.45 (deployment hub), 45.227.254.84 (operator VM with SimpleHelp console), 179.60.149.68 (staging/pivot), 89.185.83.8 (Ghost C2/credential tooling), 138.124.113.210 (Ghost panel), 77.110.109.248 (RevSocks)

Hunt only rotating infrastructure assessed 2026 10 22 — domains

iquickline.com (Phantom/Athena C2; agent callback api.iquickline.com), system-strategy.org, mcgrawney.com, driverupdate.app (retired), stackpathcloud.com (retired), cloud-update.live (MeshCentral front), bossprotect.com (phishing), trulitesupport.com (look-alike victim-customer notice), incblog.su

Hunt only rotating infrastructure assessed 2026 10 22 — url path

/assets/js/analytics.js (disguised loader)

Durable — scheduled task

RealtekAudioSvc

Durable — ems account patterns

sysadmin, fct_svc_*, ems_monitor_*

Durable — implant names

mimicking Realtek, Windows Update, WUServiceHost

Durable — driver

Zemana driver load with Quick Heal/Seqrite service termination

Durable — ioctl

0x53C028

Durable — file artifacts

.INC extension, INC-README.txt

Durable — operator handle

sm4l1st123 (attribution pivot, not a detection)

Durable — sha256 inc builds

ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4, 0ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5, 14b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212

Durable — sha256 windows kits

ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463e, ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb, ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918

Durable — sha256 linux kits

70f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82, 7ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20, 4286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885a

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of INC / The Gentlemen affiliates run intrusions through an AI agent (OpenCode + Phantom framework), with a human approving each step? Bring them to the community.

Discuss in the Tradecraft Slack