---
title: Hunt: exposed servers show INC and Gentlemen ransomware affiliates running intrusions through OpenCode, commercial models and 32 MCP servers | ctxsec
url: https://ctxsec.com/items/hunt-socradar-inc-gentlemen-phantom-opencode
description: ""
status: "confirmed research (SOCRadar, updated Oct 23); exploitation counts come from operator records and are not independently verified; INC/Gentlemen alliance rated low confidence"
published: 2026-10-23
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-socradar-inc-gentlemen-phantom-opencode.md)

confirmed research (SOCRadar, updated Oct 23); exploitation counts come from operator records and are not independently verified; INC/Gentlemen alliance rated low confidence

2026-10-23

### Hunt: exposed servers show INC and Gentlemen ransomware affiliates running intrusions through OpenCode, commercial models and 32 MCP servers

SOCRadar found an open directory on an attacker server (45.227.254[.]43) holding the operators' AI session logs, knowledge base and the source of **Phantom**, a self-styled "Autonomous Red Team Kill Chain Framework". Credentials and configs there led to six more servers. The operators drove intrusions through **OpenCode** with commercial models on OpenRouter (8,257 messages in 133 sessions, about $23,900 in API spend), with a human approving each step. When a model refused, they reworded the request as an "authorized red team assessment". "WormGPT" was only a persona prompt over 32 MCP servers.

- **Initial access (operator records):** FortiClient EMS CVE-2026-35616 (108 rogue admins created), SimpleHelp CVE-2024-57727 (242 IPs) and cPanel CVE-2026-41940; Ivanti, Citrix, SonicWall and OpenVPN gateways were also probed.
- **Payloads:** 46 INC encryptor builds for six victims staged for Oct 1, Ghost C2, RevSocks, a Cloudflare-fronted Mythic agent and a Quick Heal/Seqrite killer abusing the Zemana driver. 62 organizations are named, 36 in the US.
- **Hunt for:** new EMS admins (sysadmin, `fct_svc_*`, `ems_monitor_*`) and modified VPN on-connect scripts; a scheduled task named `RealtekAudioSvc`; Zemana driver loads followed by security-service termination; restic or rclone uploads; shadow copies deleted through IOCTL 0x53C028; `.INC` renames and `INC-README.txt`.
- **IOCs:** 45.227.254[.]43/.45/.84, 179.60.149[.]68, 89.185.83[.]8, 138.124.113[.]210, 77.110.109[.]248; domains `system-strategy[.]org`, `iquickline[.]com`, `mcgrawney[.]com`, `cloud-update[.]live`, `bossprotect[.]com`, `trulitesupport[.]com`. Hashes are in the report.

Sources: [SOCRadar STRU: INC and The Gentlemen Ransomware: Exposed AI Infrastructure (Oct 20, updated Oct 23)](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/) · [The Hacker News (Oct 23)](https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html)