Phantom

Search everything

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenOct 21, 2026
Last mentioned2d ago

Timeline

2 articles · newest first

INC and Gentlemen affiliates used AI agents in ransomware intrusions

Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.

The Hacker NewsOct 23, 17:50 UTC · 2d agoRansomwareExploitedCVE-2024-57727 CVE-2026-35616 CVE-2026-41940+45 · 2 reads

Ransomware affiliates using Claude left chats and tools exposed

SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.

Cyber Security NewsOct 21, 11:49 UTC · 4d agoRansomwareCVE-2026-35616 CVE-2024-57727 CVE-2026-419406 · 4 reads

Related CVEs

by mentions

CVE-2026-3561694%9.8
Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
published Apr 4, 2026Fortinet FortiClient EMSKEVPoC
CVE-2026-4194099%9.3
Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
published Apr 29, 2026WebPros cPanelKEVRansomwarePoC ×9
CVE-2024-5772797%7.5
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/remote access software)KEVRansomware
CVE-2026-154097%10.0
Unauthenticated SSRF in SonicWall SMA1000 Appliances
published Jul 14, 2026SonicWall SMA1000 Appliances (SMA 6210 firmware)KEVRansomwarePoC
CVE-2026-908216%9.8
Actively Exploited SQL Injection in Drupal Core
published May 20, 2026Drupal CoreKEV
CVE-2026-6303011%9.8
WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
published Jul 17, 2026WordPress CoreKEVPoC ×6
CVE-2026-422086%9.3
SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild
published May 8, 2026BerriAI LiteLLM (proxy server / AI gateway)KEVPoC

Appears with

The Gentlementhreat actor · 2
SOCRadarorganization · 2
OpenCodeproduct · 2
SimpleHelpvendor · 2
FortiClient EMSproduct · 2
cPanelvendor · 2
Fortinetvendor · 2
RevSocksmalware · 2
Anthropicvendor · 1
OpenRouterorganization · 1
QuickLinemalware · 1
INC Ransomwarethreat actor · 1
Ghost C2malware · 1
INCthreat actor · 1
cPanel/WHMproduct · 1
Ghostmalware · 1

Entities are extracted by the model from each article. First seen Oct 21, 2026, last mentioned 2d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.