Threats · 3h ago
SOCRadar linked affiliates of the INC and The Gentlemen ransomware groups to Phantom, a human-approved AI operation targeting an estimated 62 organizations through three actively exploited edge-system flaws.
Operators give the model victim-specific tasks and approve each step; when it refuses, they reframe the request as an authorized red-team test rather than switch tools. SOCRadar’s exposed logs show AI-managed records tracking victims, stolen credentials and campaign progress, as intrusions move from edge access toward domain-admin privileges, credential theft and sensitive-file exfiltration.
SOCRadar says the actively exploited flaws affect SimpleHelp, FortiClient EMS and cPanel/WHM; other listed flaws were staged or developed, not confirmed in successful intrusions. For organizations exposing these systems, patching the entry point cannot recover credentials or data already stolen, and shared records could carry access intelligence into other affiliates’ campaigns.
CVEs in this update
7 CVEs
Across simplehelp.
2 critical · 2 high · 1 medium · 0 low
7 in CISA KEV · 3 with EPSS above 1%
3 with functional or packaged public exploit code
Highest severity: CVE-2026-41940 · 9.8 CRITICAL
Highest EPSS: CVE-2026-41940 · 98.5%
8 sources covering this story
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors no longer hack in; they call help desks, impersonate trusted brands, and use AI-powered deepfakes to walk through the front door.
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Ransomware affiliates used human-approved AI workflows to exploit edge systems, steal data, and target an estimated 62 organizations.
SPONSORED: When the Attacker Becomes the User: Rethinking Account Takeover
SPONSORED: AI makes phishing easier than ever
Agentic AI helps hackers level up, even without detailed instructions
Low-skilled hackers are likely to become a lot more dangerous over the next 12 months, CrowdStrike warned.
Exploring the Risks and Impacts of AI on Vulnerability Discovery and Exploitation | Blog | VulnCheck
We take a look at how AI makes the capabilities behind each one more accessible and accelerates how quickly attackers can use them.
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
CrowdStrike Uncovers New Agentic AI Campaigns
CrowdStrike details research into four previously unreported threat actors conducting campaigns in which AI agents make decisions and execute commands.
Part of the PlainSec briefing for 2026-10-23