Skip to main content
MalwarePublished 10/21/2026

INC and The Gentlemen Ransomware: Exposed AI Infrastructure

Source AlienVault OTX General

0

Description

Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.

Impact

The campaign compromised thousands of targets, primarily in industrial manufacturing and healthcare sectors in the United States, using AI-driven ransomware operations. The presence of multiple custom encryptor builds and evidence of live victim encryption indicates active ransomware deployment causing potential data loss and operational disruption. Exposure of source code, credentials, and victim data due to OPSEC failures may facilitate further attacks or leak sensitive information.

Defensive guidance

No official patch or remediation is indicated. Mitigation should focus on identifying and securing exposed command-and-control servers and compromised edge devices such as FortiClient EMS, SimpleHelp, and cPanel systems. Organizations should review and strengthen operational security to prevent credential and source code exposure. Monitoring for indicators related to the Phantom framework, Ghost C2, and associated exploitation tools is recommended. Since this is a ransomware-as-a-service operation with AI integration, defenders should prioritize incident response readiness and network segmentation to limit lateral movement.

MITRE ATT&CK techniques

From threat tags

Indicators of compromise

Domains 13

  • bossprotect.com
  • incblog.su
  • incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
  • incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion
  • system-strategy.org
  • iquickline.com
  • mcgrawney.com
  • stackpathcloud.com
  • cloud-update.live
  • trulitesupport.com

IP addresses 7

  • 45.227.254.43CC=LT ASN=AS267784 flyservers s.a.
  • 45.227.254.45CC=LT ASN=AS267784 flyservers s.a.
  • 138.124.113.210CC=CH ASN=ASNone
  • 89.185.83.8CC=RU ASN=AS207967 anton mamaev
  • 45.227.254.84CC=LT ASN=AS267784 flyservers s.a.
  • 179.60.149.68CC=PA ASN=AS395839 hostkey
  • 77.110.109.248CC=SA ASN=ASNone

Hashes 27

  • 70f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82
  • 7ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20
  • 4286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885a
  • ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4
  • 0ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5
  • 14b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212
  • ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463e
  • ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb
  • ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918
  • 16c3366c6a65802abc37874d250fa23eMD5 of ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb

CVEs 22

  • CVE-2020-1472
  • CVE-2021-1675
  • CVE-2021-42278
  • CVE-2023-27532
  • CVE-2024-49112
  • CVE-2024-57727
  • CVE-2025-49113
  • CVE-2025-62215
  • CVE-2025-59718
  • CVE-2026-35616

Community reviews

Loading reviews…