A folder left open on the internet showed how ransomware criminals are using artificial intelligence to attack companies. What it revealed has little magic and a lot of carelessness: the intruders got in through unpatched systems and, in one case, through a single password reused in many places.
What the researchers found
According to The Hacker News, the discovery was made by SOCRadar. The operator is described as a Russian-speaking actor that breaks into companies, steals data for extortion and also provides infrastructure to ransomware partners. The campaign is linked to affiliates of two groups, INC and The Gentlemen.
Everything revolved around a framework called Phantom. The model is “AI-executed, human-approved”: a person writes the instruction for each victim and reviews every step, while the tool runs the attacks using commercial AI models. When a model refused a task, the operator reworded the request as an authorized security test instead of switching models. An exposed directory logged 8,257 messages across 133 sessions.
How they got in
The entry points were internet-facing systems such as remote access tools, VPNs and hosting panels, most with already known flaws. Once inside, the intruders escalated privileges until they controlled the whole network. The report highlights password reuse: in one case, a single password opened the VPN, the servers and even the backup and security platforms.
The pressure on victims
The criminals studied stolen financial records to estimate how much a victim could pay without involving a bank or insurer. They sent samples with masked data and pushed with phone calls and threats to notify customers, partners and regulators. With no payment in 24 to 72 hours, the data went to the leak site.
Who was in the crosshairs
About 62 organizations were targeted, and 4 appeared on leak sites. More than half of the targets were in the United States, mainly industrial, manufacturing and energy, then healthcare and pharmaceuticals. The report found no payment records, so it is unknown how much the criminals made. The lesson applies to any business, including small ones: the attack was automated, and what stopped it or let it through was the basics.
How to protect yourself
- Update everything exposed to the internet: VPN, remote access, firewall, website and hosting panels.
- Never reuse passwords across systems, especially for admin, backup and security tools. Use a password manager.
- Turn on two-step verification for email, VPN and admin panels.
- Keep backups separate from the main network, so a break-in cannot reach the copies.
- Be wary of urgent phone calls from someone claiming to be support or an agency. Phone pressure was part of the extortion.
