The most useful AI finding in SOCRadar's INC and Gentlemen report is how ordinary the stack was: OpenCode as the agent shell, standard commercial models through OpenRouter (the logs name Claude Opus 4.6 and Kimi K3), a persistent knowledge base, and a library of 18 Phantom "skills". The AI planned recon, wrote commands, triaged stolen files and drafted extortion letters; a human approved every action under the directive "coordinate every action with me".

• Refusals were handled by rewriting prompts as an "Authorized Red Team Assessment Request", not by switching to an uncensored model, which shows why authorization claims inside a prompt shouldn't be trusted.
• The AI's memory became the evidence trail: session logs and knowledge bases recorded victims, credentials and progress, which is how SOCRadar reconstructed the campaign.
• A partner guide advertised handing the whole kit (Phantom, OpenCode setup, knowledge base, MCP servers) to other operators.