Security · Updated 23 Oct, 11:20 pm IST
Researchers find AI-driven intrusion framework used by ransomware affiliates
Why it matters for readers: Demonstrates that attackers are combining AI with human oversight to make intrusions faster and more scalable.
- Researchers identified an 'Autonomous Red Team Kill Chain Framework' named Phantom powering the intrusion ecosystem.1
- The threat actor, assessed as Russian-speaking, operated as both an intrusion/data-extortion operator and an infrastructure provider for partners.1
- Operators exploited edge and remote-access systems including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways to gain initial access.1
- Intrusions were executed via OpenCode using OpenRouter-hosted commercial models in an 'AI-executed, human-approved' workflow where humans prompt and review steps.1
- An exposed directory on server 45.227.254[.]43 logged 8,257 messages across 133 sessions, showing detailed activity and knowledge-base use for tracking victims and credentials.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started