SOCRadar said it found an open server run by affiliates of the INC and The Gentlemen ransomware groups. The operators used OpenCode, an AI coding tool, with commercial models from OpenRouter. A human wrote a starting prompt for each victim. The AI then waited for approval before every step. A knowledge base kept notes on victims, stolen logins and campaign progress.
SOCRadar said this reliance on AI memory became the operators' weakness. The notes and logs now form a complete record of the campaign. Its attack details come from operator records, which it has not verified independently. It found 46 INC encryptors, programs that lock files, staged for October 1. A September 30 screenshot shows one running on a victim's workstation. SOCRadar says deployment against these targets is unconfirmed.
The same memory that tracked the victims also left the evidence. For defenders, the lasting risk is access already in place. Operator records show backdoor admin accounts in FortiClient EMS and edited VPN scripts that pushed payloads to devices. A patch fixes the flaw, but it does not delete an account or script left behind. In one case, one reused password opened the VPN, servers, remote management, backup and security tools. SOCRadar advises hunting for rogue EMS admins and edited VPN scripts.