What happened
SOCRadar exposed seven adversary-controlled servers (late Sept 2026) documenting affiliates of the INC and The Gentlemen ransomware groups running intrusions through OpenCode with OpenRouter-hosted models, a 'Phantom' autonomous red-team kill-chain framework, WormGPT-prompted MCP servers, and persistent AI knowledge bases. Analysis of 8,257 messages across 133 OpenCode sessions shows an AI-executed, human-approved operating loop, with >$23,900 recorded AI API spend and 46 staged INC encryptor builds for six victims.
Why it matters
This is an attacker-side AI-agent deployment: ransomware groups are using AI coding agents and MCP tooling as an operational co-pilot for reconnaissance, command generation, victim tracking and triage — not merely as a target. It demonstrates that AI agent infrastructure is now being wielded to compromise real organizations, and that the attackers' own AI session logs/knowledge bases become an evidence trail. It is the same class of frontier-agent capability the lab post-mortems describe, but on the offensive side.
Attack vector
AI-assisted intrusion: AI plans/executes steps under human approval; credentials and knowledge bases on exposed adversary C2 servers
Affected systems
AI-agent tooling used by threat actors (OpenCode + OpenRouter/commercial models, MCP servers); 62 named victim organizations, 36 US
Mitigation
Defender guidance: track and restrict AI-agent tooling credentials, correlate identity/workload/delivery logs, rotate credentials reachable from compromised resources