An open server exposed hackers who ran their attacks with Claude AI

The server was open to anyone. At 45.227.254[.]43, open directories let visitors browse a hacking team's knowledge base, its history of exchanges with artificial intelligence models and the source code of "Phantom," which its authors describe as an autonomous attack chain. That is the starting point of an investigation by the research unit of SOCRadar, a threat intelligence company. It published the report on October 20 and updated it on October 23.

According to SOCRadar, the operation was run by affiliates of the INC and The Gentlemen ransomware, meaning hackers who use these encryption tools and share the ransoms with their authors. Between mid-July and September 30, 2026, their intrusions were carried out by AI agents, with a human approving each step. The researchers analyzed 8,257 messages across 133 sessions. They identified 62 organizations named in the hackers' files, 36 of them in the United States.

Mainstream models, not a criminal AI

The most telling detail is the list of models. The operators used OpenCode, an open-source tool that turns a language model into an agent able to run commands. They connected it to OpenRouter, a service that gives access to many models with a single key. The logs show calls to Claude Opus 4.6, from Anthropic, and to Kimi K3, from China's Moonshot AI. The name "WormGPT" that appears in their instructions was only a role assigned to the model, not an unrestricted AI, SOCRadar explains.

When a model refused a request, the operators did not switch tools. They rephrased it as an "authorized red team assessment request," in other words a fake penetration test ordered by a client. The report puts their AI spending at $23,920. On October 5, two paid OpenRouter accounts were still active. We have found no public reaction so far from Anthropic, Moonshot AI or OpenRouter.

This is not an isolated case: CrowdStrike had already described the use of Claude Code in the hacking of South Korean banks. Ironically, here it is the AI's memory that betrayed the hackers: according to SOCRadar, their knowledge bases and session logs trace the entire operation.

Well-known entry points

As for vulnerabilities, the AI invented nothing. According to the operators' own records, which SOCRadar could not verify, most of the access came from internet-exposed equipment:

• Fortinet's FortiClient EMS console (CVE-2026-35616): 2,236 targets and 108 administrator accounts created;
• the SimpleHelp remote support tool (CVE-2024-57727): 4,922 servers scanned and 427 administrator passwords recovered; SOCRadar also notes that credentials stolen from managed service provider technicians opened access to every client they managed;
• cPanel/WHM hosting consoles (CVE-2026-41940), at small hosting providers.

Once inside the network, password reuse was the main accelerator, according to SOCRadar. In one case, the same password opened the VPN, the servers, the remote maintenance tool, the backups and the security console. The operators had prepared 46 versions of the INC encryptor for six victims. They preferred, however, to steal data and threaten to publish it rather than encrypt everything.

What to do

SOCRadar's recommendations target these same entry points:

• patch FortiClient EMS and remove its administration interfaces from the internet, then look for unknown administrators (for example fct_svc_* or ems_monitor_*) and modified VPN login scripts;
• inventory, patch and restrict remote access tools (SimpleHelp, MeshCentral, N-central), and require two-factor authentication from your managed service providers;
• never reuse an administrator password across the VPN, backups and security tools;
• protect backups with an immutable or offline copy.

One question remains open: who supplies these tools? SOCRadar leans toward a single provider equipping several teams in the ransomware ecosystem. On a neighboring server, an onboarding guide was already offering Phantom to outside operators.