SOCRadar found an open directory on an attacker server (45.227.254[.]43) holding the operators' AI session logs, knowledge base and the source of Phantom, a self-styled "Autonomous Red Team Kill Chain Framework". Credentials and configs there led to six more servers. The operators drove intrusions through OpenCode with commercial models on OpenRouter (8,257 messages in 133 sessions, about $23,900 in API spend), with a human approving each step. When a model refused, they reworded the request as an "authorized red team assessment". "WormGPT" was only a persona prompt over 32 MCP servers.

• Initial access (operator records): FortiClient EMS CVE-2026-35616 (108 rogue admins created), SimpleHelp CVE-2024-57727 (242 IPs) and cPanel CVE-2026-41940; Ivanti, Citrix, SonicWall and OpenVPN gateways were also probed.
• Payloads: 46 INC encryptor builds for six victims staged for Oct 1, Ghost C2, RevSocks, a Cloudflare-fronted Mythic agent and a Quick Heal/Seqrite killer abusing the Zemana driver. 62 organizations are named, 36 in the US.
• Hunt for: new EMS admins (sysadmin, fct_svc_*, ems_monitor_*) and modified VPN on-connect scripts; a scheduled task named RealtekAudioSvc; Zemana driver loads followed by security-service termination; restic or rclone uploads; shadow copies deleted through IOCTL 0x53C028; .INC renames and INC-README.txt.
• IOCs: 45.227.254[.]43/.45/.84, 179.60.149[.]68, 89.185.83[.]8, 138.124.113[.]210, 77.110.109[.]248; domains system-strategy[.]org, iquickline[.]com, mcgrawney[.]com, cloud-update[.]live, bossprotect[.]com, trulitesupport[.]com. Hashes are in the report.