SOCRadar researchers found seven exposed servers tied to affiliates of the INC and The Gentlemen ransomware operations, and the machines held thousands of AI chat messages, custom encryptor builds and a list of 62 named victims. The company discovered the servers on October 20 and reported its findings on October 21.
What the Seven Exposed Servers Contained
The servers held 8,257 AI messages spread across 133 OpenCode sessions. They also contained 46 custom INC encryptor builds prepared for six victims, stolen credentials, and command-and-control and security-disabling tools. Records on the servers show more than $23,920 in AI API spending.
Claude Opus 4.6, Kimi K3 and the Phantom Framework
According to SOCRadar, the affiliates used the models Claude Opus 4.6 and Kimi K3. They accessed them through OpenCode and through a custom framework called Phantom. The servers also included a WormGPT-labeled MCP server.
The findings offer a view into how ransomware affiliates are building AI into day-to-day operations. The chat logs and session records document the operators’ interactions with the models, and the encryptor builds show tailored preparation for specific victims.
Vulnerabilities the Affiliates Exploited
SOCRadar linked the activity to three vulnerabilities in widely deployed software.
CVE-2026-41940 in cPanel, CVE-2024-57727 in SimpleHelp and CVE-2026-35616 in FortiClient EMS
The cPanel flaw, CVE-2026-41940, is tied to claims of at least 49 breaches. For SimpleHelp, CVE-2024-57727, the affiliates scanned 4,922 servers and obtained 427 administrator passwords. For FortiClient EMS, CVE-2026-35616, the data lists 2,236 claimed targets.
The figures describe attacker claims and scanning volumes recorded on the exposed servers. They do not amount to confirmed counts of compromised organizations.
The 62 Named Victims
The data names 62 victim organizations, 36 of them in the United States. Manufacturing and industrial companies make up 16.1 percent of the list and healthcare and pharmaceutical organizations account for 14.5 percent.
The victim list can assist with notification, since it identifies organizations that may not yet know they were targeted. SOCRadar published its findings, and the source reports no law enforcement action related to the servers.
Relationship to Earlier Gentlemen Coverage
The discovery follows earlier reporting on a Gentlemen affiliate that used MCP as a command channel. The new findings focus on the exposed infrastructure, its scale and the victim data.
Scanning and Credential Theft Figures
The SimpleHelp numbers stand out: the servers recorded scans of 4,922 SimpleHelp servers and 427 administrator passwords obtained, a hit rate of roughly 8.7 percent. The cPanel figure of 49 or more claimed breaches and the FortiClient EMS figure of 2,236 claimed targets come from the same material. Alongside those records, the servers held stolen credentials and tools for disabling security software, which together cover access, defense evasion and encryption stages of an intrusion.
Timeline
SOCRadar found the servers on October 20. The company’s findings were reported on October 21. The article’s sources do not state when the servers were set up or how long they remained exposed.
Impact
The exposure gives an unusually detailed record of AI-accelerated ransomware operations. The $23,920 in recorded API spend, the 8,257 messages and the 133 sessions put numbers on how heavily the affiliates relied on commercial and open models during intrusion planning and tooling. The 46 encryptor builds prepared for six victims show that the preparation was tied to specific targets rather than generic malware.
The cPanel, SimpleHelp and FortiClient EMS activity shows affiliates working across several unrelated products. The victim list is concentrated in manufacturing and industrial firms and in healthcare and pharmaceuticals, together accounting for 30.6 percent of the 62 named organizations. SOCRadar has published the findings, and the source reports no statements from the named victims.
