```
Cybersecurity researchers have uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups, according to a report covered by The Hacker News in its October 2026 coverage. The discovery came neither from a victim-side breach notification nor from a law-enforcement seizure. Instead, analysts found infrastructure tied to the operation sitting exposed — reachable outside the perimeter its operators apparently intended — and that exposure is what gave them a view of how the affiliates actually work.
The Phantom kill chain
At the centre of the setup is a component the researchers call Phantom, described as an "Autonomous Red Team Kill Chain Framework." In practice, the label positions Phantom as an orchestration layer for intrusion activity: a system intended to carry an attack through its stages rather than assist a human operator at each individual step.
The framing matters for defenders. A ransomware affiliate working through a checklist is one thing; an affiliate running a framework that sequences reconnaissance, access, movement and exfiltration as a linked pipeline is a different operational profile. The practical consequence is tempo. If kill-chain stages are handed off automatically instead of waiting on a human to review each transition, dwell-time assumptions built around attacker deliberation start to erode.
The report's characterisation of the tooling as "autonomous" should be read as the operators' own claim about their system rather than as a verified technical description of unconstrained agent behaviour. What has been established is the structure — a named framework consolidating the intrusion workflow — not the degree to which it runs without human intervention. How much oversight sits inside Phantom remains unverified in the material available.
An assessed Russian-speaking operator with two jobs
The threat actor behind the ecosystem is assessed to be Russian-speaking. The report also describes the individual as functioning both as an intrusion operator and as a data-extortion operator — a dual role that collapses what is often a hand-off between separate parties in a modern ransomware economy.
Fewer hand-offs mean fewer intermediaries, which in turn means fewer opportunities for leaked credentials, sloppy ticketing or noisy transfer traffic between groups. For investigators, the traditional signal chain — intrusion affiliate hands to extortion affiliate, who negotiates — may simply not appear.
What it means for detection and IR playbooks
For enterprise security teams, the relevant point is not the novelty of AI in cybercrime, which is by now a crowded story, but the homogeneity it can produce. Affiliates leaning on a shared framework would, in principle, be expected to exhibit shared behaviour: similar stage sequencing, similar timing patterns, similar artefact ordering. That regularity is detectable in principle, and it argues for IR playbooks tuned against machine-speed transitions rather than human-paced ones — alert thresholds and escalation windows reviewed with the assumption that an attacker's next action may arrive in seconds, not hours.
There is also a general relevance here beyond this particular case. Agentic tooling is no longer confined to legitimate red-team products; whatever the true degree of autonomy in Phantom, the direction of travel puts autonomous-style kill chains in the hands of criminal affiliates, and defensive assumptions calibrated to human-paced intrusion will age quickly.
What the findings do and do not support
A single assessed actor, a product name, and a category claim ("AI agents") can each be repeated until they sound like settled fact, but the available material does not support treating them that way. The durable findings are the narrower ones: a named framework consolidating the kill chain, an exposed-infrastructure discovery that made the workflow visible, and an operator holding both intrusion and extortion roles.
Several questions remain open, and the report does not close them. No indicator-of-compromise set has been published alongside the claims. The degree of human oversight within Phantom is unverified. Victim scope and the identity of the researching team are unstated. Attribution and autonomy rest on weaker evidence than the structural findings do.
The report is available via The Hacker News.
```
據 The Hacker News 於 2026 年 10 月報道的報告披露，網絡安全研究人員發現一個由 INC 及 The Gentlemen 勒索軟件集團附屬成員營運的 AI 驅動入侵生態系統。有關發現既非來自受害者的外洩通報，亦非源於執法部門的充公行動。相反，分析人員發現與該行動相關的基建設施曝露在外——可從操作者原本預設的防線之外存取——正是這次曝露讓他們得以一窺附屬成員的實際運作方式。
Phantom kill chain
整個系統的核心是一個研究人員稱為 Phantom 的組件，被描述為「自主 Red Team Kill Chain Framework（自主紅隊殺傷鏈框架）」。實際上，這一定位將 Phantom 置於入侵活動的編排層角色：該系統旨在令攻擊自動貫穿各個階段，而非在每個步驟協助人類操作者。
這一定性對防禦者而言至關重要。按清單逐步行事的勒索軟件附屬成員是一回事；營運一個將偵察、取得權限、橫向移動及資料外洩串連成一條 pipeline 的框架的附屬成員，則屬另一種作戰模式。實際影響在於節奏。若 kill-chain 各階段由系統自動交接，而非等待人類逐一審核每次轉換，那麼建立在攻擊者深思熟慮假設之上的 dwell-time（潛伏時間）推算便會開始失效。
報告將相關工具形容為「自主」，應理解為操作者對其系統的自我宣稱，而非經核實、描述不受限制 agent 行為的技術說明。已獲確認的是其結構——一個將入侵工作流程整合起來的具名框架——至於其在多大程度上無需人手介入便能運行，則未經證實。Phantom 內部究竟設有多少監督機制，在現有材料中仍未得到驗證。
一名據評估為俄語使用者的身兼二職操作者
該生態系統背後的威脅行為者據評估為俄語使用者。報告亦指此人同時擔任入侵操作者及資料勒索操作者——這種雙重角色，將現代勒索軟件經濟中通常由不同方之間進行的交接合而為一。
交接減少意味著中介人減少，從而降低憑證外洩、工單處理草率或團體之間傳輸流量惹人注目的機會。對調查人員而言，傳統的信號鏈——入侵附屬成員交接予勒索附屬成員，再由後者談判——可能根本不會出現。
對偵測及 IR playbooks 的意義
對企業安全團隊而言，重點不在於 AI 用於網絡罪行的新穎性——此題材如今已是老生常談——而在於其可能造成的同質化。原則上，倚賴共用框架的附屬成員理應表現出行為一致性：相似的階段序列、相似的時序模式、相似的 artefact（攻擊遺留跡證）順序。這種規律性原則上是可以偵測的，亦正因如此，IR playbooks（事件應變手冊）應針對機器速度的轉換而非人類節奏來調校——警報門檻及升級時限的檢視，須以攻擊者的下一步行動可能在數秒而非數小時內到來為假設。
此外，本案亦具有一般層面的參考價值。Agentic 工具已不再局限於正規的 red-team 產品；無論 Phantom 的實際自主程度如何，發展趨勢已將自主式 kill chain 交到罪犯附屬成員手中，而按人類節奏入侵所校準的防禦假設，將很快過時。
研究結果支持與不支持的範疇
一個據評估的行為者、一個產品名稱，以及一項類別宣稱（「AI agents」），各自都可以被一再重述，以至聽起來如同既定事實，但現有材料並不支持如此處理。站得住腳的發現範圍較窄：一個將 kill chain 整合起來的具名框架、一項令工作流程得以曝光的基建設施外洩發現，以及一名同時兼任入侵與勒索角色的操作者。
若干問題仍然懸而未決，報告並未加以解答。與有關宣稱一併發表的 indicator-of-compromise（IOC，入侵指標）並不存在。Phantom 內部的人為監督程度未經核實。受害者範圍及研究團隊的身份均未交代。歸因（attribution）及自主性所依賴的證據，均比結構性發現薄弱。
報告可透過 The Hacker News 瀏覽。