Threats & Adversaries · Ransomware
Ransomware affiliates use AI to coordinate edge intrusions SOCRadar linked affiliates of the INC and The Gentlemen ransomware groups to Phantom, a human-approved AI operation targeting an estimated 62 organizations through three actively exploited edge-system flaws.
Operators give the model victim-specific tasks and approve each step; when it refuses, they reframe the request as an authorized red-team test rather than switch tools. SOCRadar’s exposed logs show AI-managed records tracking victims, stolen credentials and campaign progress, as intrusions move from edge access toward domain-admin privileges, credential theft and sensitive-file exfiltration.
SOCRadar says the actively exploited flaws affect SimpleHelp, FortiClient EMS and cPanel/WHM; other listed flaws were staged or developed, not confirmed in successful intrusions. For organizations exposing these systems, patching the entry point cannot recover credentials or data already stolen, and shared records could carry access intelligence into other affiliates’ campaigns.
8 sources · 4h ago
CVEs in this update
7 CVEs
Across simplehelp.
2 critical · 2 high · 1 medium · 0 low
7 in CISA KEV · 3 with EPSS above 1%
3 with functional or packaged public exploit code
Highest severity: CVE-2026-41940 · 9.8 CRITICAL
Highest EPSS: CVE-2026-41940 · 98.5%
Timeline Oct 23 Reported by Dark Reading Oct 22 Reported by The Register Security Oct 21 Reported by SecurityWeek Jul 24 CISA federal deadline for CVE-2026-63030 passedJul 21 CVE-2026-63030 added to CISA KEVJul 17 CISA federal deadline for CVE-2026-15409 passedJul 14 CVE-2026-15409 added to CISA KEVMay 27 CISA federal deadline for CVE-2026-9082 passedMay 22 CVE-2026-9082 added to CISA KEVMay 11 CISA federal deadline for CVE-2026-42208 passedMay 8 CVE-2026-42208 added to CISA KEVMay 3 CISA federal deadline for CVE-2026-41940 passedApr 30 CVE-2026-41940 added to CISA KEVApr 9 CISA federal deadline for CVE-2026-35616 passedApr 6 CVE-2026-35616 added to CISA KEVMar 6 CISA federal deadline for CVE-2024-57727 passedFeb 13 CVE-2024-57727 added to CISA KEVSources Oct 23 Dark Reading
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors no longer hack in; they call help desks, impersonate trusted brands, and use AI-powered deepfakes to walk through the front door.
original Oct 23 The Hacker News
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Ransomware affiliates used human-approved AI workflows to exploit edge systems, steal data, and target an estimated 62 organizations.
original Oct 22 The Register Security
SPONSORED: When the Attacker Becomes the User: Rethinking Account Takeover
SPONSORED: AI makes phishing easier than ever
original Vendor digest: Fortinet
Part of the PlainSec briefing for 2026-10-23
Every edition of this story: Ransomware affiliates use AI to coordinate edge intrusions
More from today Threats & Adversaries · Ransomware
Ransomware affiliates use AI to coordinate edge intrusions SOCRadar linked affiliates of the INC and The Gentlemen ransomware groups to Phantom, a human-approved AI operation targeting an estimated 62 organizations through three actively exploited edge-system flaws.
Operators give the model victim-specific tasks and approve each step; when it refuses, they reframe the request as an authorized red-team test rather than switch tools. SOCRadar’s exposed logs show AI-managed records tracking victims, stolen credentials and campaign progress, as intrusions move from edge access toward domain-admin privileges, credential theft and sensitive-file exfiltration.
SOCRadar says the actively exploited flaws affect SimpleHelp, FortiClient EMS and cPanel/WHM; other listed flaws were staged or developed, not confirmed in successful intrusions. For organizations exposing these systems, patching the entry point cannot recover credentials or data already stolen, and shared records could carry access intelligence into other affiliates’ campaigns.
8 sources · 4h ago
CVEs in this update
7 CVEs
Across simplehelp.
2 critical · 2 high · 1 medium · 0 low
7 in CISA KEV · 3 with EPSS above 1%
3 with functional or packaged public exploit code
Highest severity: CVE-2026-41940 · 9.8 CRITICAL
Highest EPSS: CVE-2026-41940 · 98.5%
Timeline Oct 23 Reported by Dark Reading Oct 22 Reported by The Register Security Oct 21 Reported by SecurityWeek Jul 24 CISA federal deadline for CVE-2026-63030 passedJul 21 CVE-2026-63030 added to CISA KEVJul 17 CISA federal deadline for CVE-2026-15409 passedJul 14 CVE-2026-15409 added to CISA KEVMay 27 CISA federal deadline for CVE-2026-9082 passedMay 22 CVE-2026-9082 added to CISA KEVMay 11 CISA federal deadline for CVE-2026-42208 passedMay 8 CVE-2026-42208 added to CISA KEVMay 3 CISA federal deadline for CVE-2026-41940 passedApr 30 CVE-2026-41940 added to CISA KEVApr 9 CISA federal deadline for CVE-2026-35616 passedApr 6 CVE-2026-35616 added to CISA KEVMar 6 CISA federal deadline for CVE-2024-57727 passedFeb 13 CVE-2024-57727 added to CISA KEVSources Oct 23 Dark Reading
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors no longer hack in; they call help desks, impersonate trusted brands, and use AI-powered deepfakes to walk through the front door.
original Oct 23 The Hacker News
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Ransomware affiliates used human-approved AI workflows to exploit edge systems, steal data, and target an estimated 62 organizations.
original Oct 22 The Register Security
SPONSORED: When the Attacker Becomes the User: Rethinking Account Takeover
SPONSORED: AI makes phishing easier than ever
original Vendor digest: Fortinet
Part of the PlainSec briefing for 2026-10-23
Every edition of this story: Ransomware affiliates use AI to coordinate edge intrusions
More from today