AI-Driven Intrusion Ecosystem Phantom Used by INC and Gentlemen Ransomware Affiliates

Researchers from The Hacker News have uncovered an artificial intelligence-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is the "Autonomous Red Team Kill Chain Framework" known as Phantom. The threat actor is assessed to be Russian-speaking and functions as both an intrusion operator and data-extortion affiliate. Phantom automates various stages of the kill chain, enabling more efficient network penetration and data exfiltration. The exposure of this infrastructure suggests ongoing activity and highlights the growing convergence of AI capabilities with ransomware operations. While specific technical details of the Phantom framework remain under analysis, the discovery indicates a shift toward automated, large-scale intrusions that could significantly elevate risks for organizations without AI-aware defensive measures. The researchers note that exact technical architecture, specific AI models employed, and confirmed victim counts are yet to be fully validated.