Pinned Tweet
A Joint Operation by #Lynx and #INC Ransomware Groups: #FortiBleed
FortiGate Credentials → Ransomware Deployment
We've unmasked the actors behind the campaign.
An affiliate's mistake exposed both groups' members.
Want to know who they are, and how we tracked them?
Check out o/VybuVrAm5p
FortiGate Credentials → Ransomware Deployment
We've unmasked the actors behind the campaign.
An affiliate's mistake exposed both groups' members.
Want to know who they are, and how we tracked them?
Check out o/VybuVrAm5p
0
5
28
3,533
Faruk retweeted
🚨 Exposed infrastructure reveals how ransomware affiliates used AI to hack networks and steal data.
8,257 messages. 133 AI sessions. 62 organizations targeted.
Operators exploited Fortinet, SimpleHelp, and cPanel flaws.
Inside the operation ↓ thehackernews.com/2026/10/expose…
8,257 messages. 133 AI sessions. 62 organizations targeted.
Operators exploited Fortinet, SimpleHelp, and cPanel flaws.
Inside the operation ↓ thehackernews.com/2026/10/expose…
14
30
151
34,032
Faruk retweeted
🚨 EXPOSED SERVERS REVEAL AN AI-ASSISTED RANSOMWARE WORKBENCH TIED TO INC AND THE GENTLEMEN
A threat research report published Oct 20, 2026 describes seven exposed adversary servers used by affiliates of the INC and The Gentlemen ransomware operations, with 62 targeted than $23,920 spent on commercial AI services. The investigation began in late September, after operator OPSEC failures left the servers' open directories exposed.
What the report says the servers held:
• OpenCode AI session logs (8,257 messages across 133 sessions) using commercial models: the AI planned recon, generated commands and triaged stolen data, but waited for the human operator's approval before every step
• Source code for "Phantom", an autonomous red-team framework with 18 skill modules, alongside Ghost C2, RevSocks, MCP servers and exfiltration tools; plus extortion procedures and scripted vishing
• 46 custom INC encryptor builds for six victims, packed on Sep 30 for a planned Oct 1 deployment wave
• A Sep 30 screenshot showing the encryptor running on one victim workstation
• Operator records of mass exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940); those counts are the operators' own and not independently verified
⚠️ Analyst Note:
This is firsthand research from the team that found the servers, not independent validation. The researchers link the workbench to both INC and The Gentlemen operations but rate a formal alliance as low confidence; a shared tooling environment used by several partners is the more likely model. Staged builds do not prove deployment: the planned Oct 1 encryption wave is unconfirmed beyond the one workstation screenshot. The report grades organizations by depth of activity, including reconnaissance-only targets; DDW does not name them, and none should be read as a confirmed breach. Defenders: patch FortiClient EMS, SimpleHelp and cPanel/WHM, check EMS for unauthorized admin accounts, and lock down RMM tools.
Source: socradar.io/resources/whit…
#DDW #DarkWeb #Ransomware #AISecurity #INCRansomware #TheGentlemen #ThreatIntelligence
A threat research report published Oct 20, 2026 describes seven exposed adversary servers used by affiliates of the INC and The Gentlemen ransomware operations, with 62 targeted than $23,920 spent on commercial AI services. The investigation began in late September, after operator OPSEC failures left the servers' open directories exposed.
What the report says the servers held:
• OpenCode AI session logs (8,257 messages across 133 sessions) using commercial models: the AI planned recon, generated commands and triaged stolen data, but waited for the human operator's approval before every step
• Source code for "Phantom", an autonomous red-team framework with 18 skill modules, alongside Ghost C2, RevSocks, MCP servers and exfiltration tools; plus extortion procedures and scripted vishing
• 46 custom INC encryptor builds for six victims, packed on Sep 30 for a planned Oct 1 deployment wave
• A Sep 30 screenshot showing the encryptor running on one victim workstation
• Operator records of mass exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940); those counts are the operators' own and not independently verified
⚠️ Analyst Note:
This is firsthand research from the team that found the servers, not independent validation. The researchers link the workbench to both INC and The Gentlemen operations but rate a formal alliance as low confidence; a shared tooling environment used by several partners is the more likely model. Staged builds do not prove deployment: the planned Oct 1 encryption wave is unconfirmed beyond the one workstation screenshot. The report grades organizations by depth of activity, including reconnaissance-only targets; DDW does not name them, and none should be read as a confirmed breach. Defenders: patch FortiClient EMS, SimpleHelp and cPanel/WHM, check EMS for unauthorized admin accounts, and lock down RMM tools.
Source: socradar.io/resources/whit…
#DDW #DarkWeb #Ransomware #AISecurity #INCRansomware #TheGentlemen #ThreatIntelligence
0
2
13
5,425
New #RAT: Stadia, developed by the author of #StealC
Live C2 Panel: 93.152.220[.]30
Advertised capabilities:
- Browser-based HVNC (shared/hidden desktop)
- StealC v3.5-based stealer
- In-memory/disk loader, remote CMD, file & process management
- Targets 50+ browsers, 120+ cryplets
- Crypto wallet brute-force functionality
Plymouth TA stated: "All StealC customers are offered a free month with the Pro plan!"
Additional C2 IPs:
2.27.248[.]147
45.194.66[.]165
Live C2 Panel: 93.152.220[.]30
Advertised capabilities:
- Browser-based HVNC (shared/hidden desktop)
- StealC v3.5-based stealer
- In-memory/disk loader, remote CMD, file & process management
- Targets 50+ browsers, 120+ cryplets
- Crypto wallet brute-force functionality
Plymouth TA stated: "All StealC customers are offered a free month with the Pro plan!"
Additional C2 IPs:
2.27.248[.]147
45.194.66[.]165
1
4
28
1,610
Well... our research actually uncovered a custom MCP server called "ransom-ops" that handles much of this, including negotiation strategies, victim response analysis, and even recommendations on ransom demands.
Check out our report for more details: socradar.io/resources/whit…
Check out our report for more details: socradar.io/resources/whit…
Wonder if any first line ransomware support response from ransomware gangs negotiations are using agents for automated responses until its near completed the negotiation before handing back to a real person 🤔🤔🤔
1
0
8
796
Faruk retweeted
🚨 BREAKING: AI-enabled ransomware hackers using Claude left their logs on an open server.
SOCRadar found 8k+ AI messages from INC and The Gentlemen affiliates using Claude and Kimi, plus 46 INC encryptor builds.
To fight refusals, they authorized it by calling it red-teaming.
SOCRadar found 8k+ AI messages from INC and The Gentlemen affiliates using Claude and Kimi, plus 46 INC encryptor builds.
To fight refusals, they authorized it by calling it red-teaming.
26
144
979
72,820
🚨 New Research | AI-Driven #Ransomware Operations Exposed
We identified an AI-driven intrusion ecosystem associated with INC and The Gentlemen #Ransomware affiliates. The investigation uncovered seven exposed adversary-controlled servers containing AI session histories, ases, credentials, and the source code of #Phantom, an Autonomous Red Team Kill Chain Framework.
Key findings:
- 62 Identified Victims (36 US-based)
-46 customized INC Ransomware encryptor builds
- $23K+ in AI service spending
- AI session logs and operational knowledge bases
- Phantom, Ghost C2, RevSocks, and custom offensive tooling
Blog: socradar.io/blog/inc-gentl…
Whitepaper: socradar.io/resources/whit…
#ThreatIntelligence #CTI #ThreatHunting #Malware
We identified an AI-driven intrusion ecosystem associated with INC and The Gentlemen #Ransomware affiliates. The investigation uncovered seven exposed adversary-controlled servers containing AI session histories, ases, credentials, and the source code of #Phantom, an Autonomous Red Team Kill Chain Framework.
Key findings:
- 62 Identified Victims (36 US-based)
-46 customized INC Ransomware encryptor builds
- $23K+ in AI service spending
- AI session logs and operational knowledge bases
- Phantom, Ghost C2, RevSocks, and custom offensive tooling
Blog: socradar.io/blog/inc-gentl…
Whitepaper: socradar.io/resources/whit…
#ThreatIntelligence #CTI #ThreatHunting #Malware
0
6
23
1,156
Another #UNC6671 #phishing domain:
signin-options[.]com (2026-10-05)
Observed subdomains:
aave.signin-options[.]com
dwt.signin-options[.]com
fennemorelaw.signin-options[.]com
klgates.signin-options[.]com
thompsonhine.signin-options[.]com
bipc.signin-options[.]com
m
schwab.signin-options[.]com
Same *-options naming pattern
signin-options[.]com (2026-10-05)
Observed subdomains:
aave.signin-options[.]com
dwt.signin-options[.]com
fennemorelaw.signin-options[.]com
klgates.signin-options[.]com
thompsonhine.signin-options[.]com
bipc.signin-options[.]com
m
schwab.signin-options[.]com
Same *-options naming pattern
Additional #phishing domains potentially associated with #UNC6671
mfaoptions[.]com
mfa-options[.]com
Both domains were registered on the same day(2026-08-26) and appear to follow the same MFA-themed infrastructure pattern. @socradar has also flagged them as malicious.
1
2
9
1,047
Update on #UNC6671:
New subdomain:
gunder[.]signinsettings[.]com → 46.19.136[.]147
Same IP previously observed hosting myaccountapps[.]com subdomains.
New subdomain:
gunder[.]signinsettings[.]com → 46.19.136[.]147
Same IP previously observed hosting myaccountapps[.]com subdomains.
Another #UNC6671 domain: myssosettings[.]com (Registration Date: 2026-10-02)
pillsburylaw[.]myssosettings[.]com
steris[.]myssosettings[.]com
linklaters[.]myssosettings[.]com
iag[.]myssosettings[.]com
medibank[.]myssosettings[.]com
fisherphillips[.]myssosettings[.]com
Worth watching: signinsettings[.]com - Registered on 2026-10-02 via NICENIC, Cloudflare NS
@malwrhunterteam @1ZRR4H @TLP_R3D
0
3
15
1,657
Faruk retweeted
SOCRadar Threat Research Unit (STRU) has published new research on #ICMacOS (Icarus macOS), a macOS Malware-as-a-Service that rapidly evolved from an infostealer into a persistent RAT.
Full breakdown 👉 socradar.io/blog/icmacos-i…
Full breakdown 👉 socradar.io/blog/icmacos-i…
2
7
20
1,483
Faruk retweeted
New Okta Vishing Theme: "Contact"
Themes switching: support -> claims -> report -> contact
Hunt for:
- contact-{org}.com
- {org}.contact
Tracked through @ValidinLLC
Themes switching: support -> claims -> report -> contact
Hunt for:
- contact-{org}.com
- {org}.contact
Tracked through @ValidinLLC
2
6
17
1,549
🚨 UNC6671 INFRASTRUCTURE UPDATE ⚖️
Fresh legal-sector impersonation observed:
🔎 hollandhart.myssoauth[.]com
The hostname appears to spoof US law firm Holland & Hart and continues the cluster’s SSO/authentication theme.
Detection at observation: 0/92 👀
#UNC6671
0
1
3
285
Faruk retweeted
🚨 UNC6671 INFRASTRUCTURE UPDATE ⚖️
Fresh legal-sector impersonation observed:
🔎 hollandhart.myssoauth[.]com
The hostname appears to spoof US law firm Holland & Hart and continues the cluster’s SSO/authentication theme.
Detection at observation: 0/92 👀
#UNC6671
Fresh legal-sector impersonation observed:
🔎 hollandhart.myssoauth[.]com
The hostname appears to spoof US law firm Holland & Hart and continues the cluster’s SSO/authentication theme.
Detection at observation: 0/92 👀
#UNC6671
0
4
5
1,560
Faruk retweeted
New STRU Research: NetScaler C2
An autonomous framework designed to identify Citrix devices at scale, fingerprint their versions, exploit CVE-2026-88771 and deploy a lightweight agent.
socradar.io/blog/netscaler…
An autonomous framework designed to identify Citrix devices at scale, fingerprint their versions, exploit CVE-2026-88771 and deploy a lightweight agent.
socradar.io/blog/netscaler…
0
10
25
2,992
Great to see @socradar's #FortiBleed research cited in the joint FBI & U.S. Secret Service cybersecurity advisory 🙌
A global credential-compromise campaign known as FortiBleed is actively targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. Today, the @FBI and @SecretService issued a Joint Cybersecurity Advisory to warn s activity.
Threat actors are exploiting reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication at scale. More than 86,644 devices have been compromised across 194 countries, with some organizations locked out of systems.
We encourage organizations to review the advisory for TTPs and IOCs associated with this activity and implement our recommended mitigations.
👉ic3.gov/CSA/2026/26100…
0
1
0
189
Another #UNC6671 domain: myssosettings[.]com (Registration Date: 2026-10-02)
pillsburylaw[.]myssosettings[.]com
steris[.]myssosettings[.]com
linklaters[.]myssosettings[.]com
iag[.]myssosettings[.]com
medibank[.]myssosettings[.]com
fisherphillips[.]myssosettings[.]com
Worth watching: signinsettings[.]com - Registered on 2026-10-02 via NICENIC, Cloudflare NS
@malwrhunterteam @1ZRR4H @TLP_R3D
pillsburylaw[.]myssosettings[.]com
steris[.]myssosettings[.]com
linklaters[.]myssosettings[.]com
iag[.]myssosettings[.]com
medibank[.]myssosettings[.]com
fisherphillips[.]myssosettings[.]com
Worth watching: signinsettings[.]com - Registered on 2026-10-02 via NICENIC, Cloudflare NS
@malwrhunterteam @1ZRR4H @TLP_R3D
Another root domain: mfasettings[.]com , #UNC6671
Follows the same identity/MFA-themed naming pattern, no subdomain yet.
Registered on Sep 21 via NICENIC, uses Cloudflare NS, and currently resolves to 102.220.163[.]94 (VPS Dedicated LLC).
1
1
11
1,803
Faruk retweeted
🚨 Threat actor unmasked: CyberXero 🎭
STRU has identified a new Russian IAB #TA operating two distinct pipelines targeting critical infrastructure in Ukraine and other countries, alongside WordPress sites worldwide.
Using PentAGI, +50 agents, Cobalt Strike and dedicated frastructure and Telegram notification.
👽 Blogpost: socradar.io/blog/cyberxero…
🔗 Full report: socradar.io/resources/repo…
#ThreatIntelligence #CTI #ThreatResearch #AI #IAB #threat #campaign
STRU has identified a new Russian IAB #TA operating two distinct pipelines targeting critical infrastructure in Ukraine and other countries, alongside WordPress sites worldwide.
Using PentAGI, +50 agents, Cobalt Strike and dedicated frastructure and Telegram notification.
👽 Blogpost: socradar.io/blog/cyberxero…
🔗 Full report: socradar.io/resources/repo…
#ThreatIntelligence #CTI #ThreatResearch #AI #IAB #threat #campaign
1
13
24
2,618
Really excited to be speaking at #BSidesBournemouth this November!
I’ll be sharing the story behind our FortiBleed investigation - from hunting 450+ servers to an OPSEC mistake that exposed a much wider ransomware operation linked to INC and Lynx Ransomware groups.
See you in Bournemouth! 🎯
I’ll be sharing the story behind our FortiBleed investigation - from hunting 450+ servers to an OPSEC mistake that exposed a much wider ransomware operation linked to INC and Lynx Ransomware groups.
See you in Bournemouth! 🎯
another one. ☠️⚡
Faruk Sener, SOCRadar. BSides Bournemouth, 7 Nov.
how one OPSEC mistake unravelled a ransomware op and exposed 450+ servers 🎯
TOXMAN. INC. Lynx. UK in the crosshairs. unpublished artifacts.
bsides-bournemouth.org/tickets #BSidesBournemouth #InfoSec
0
1
4
232