RevSocks

Search everything

Mentions · 7d3
Mentions · 30d3
All mentions3
First seenOct 21, 2026
Last mentioned2d ago

Timeline

3 articles · newest first

INC and Gentlemen affiliates used AI agents in ransomware intrusions

Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.

The Hacker NewsOct 23, 17:50 UTC · 2d agoRansomwareExploitedCVE-2024-57727 CVE-2026-35616 CVE-2026-41940+45 · 2 reads

Ransomware affiliates using Claude left chats and tools exposed

SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.

Cyber Security NewsOct 21, 11:49 UTC · 4d agoRansomwareCVE-2026-35616 CVE-2024-57727 CVE-2026-419406 · 4 reads

INC affiliates left servers open, exposing AI-assisted ransomware operations

SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.

GBHackersOct 21, 05:57 UTC · 4d agoRansomware 6 sourcesCVE-2026-35616 CVE-2024-57727 CVE-2026-419406 · 4 reads

Related CVEs

by mentions

CVE-2026-3561694%9.8
Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
published Apr 4, 2026Fortinet FortiClient EMSKEVPoC
CVE-2026-4194099%9.3
Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
published Apr 29, 2026WebPros cPanelKEVRansomwarePoC ×9
CVE-2024-5772797%7.5
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/remote access software)KEVRansomware
CVE-2026-154097%10.0
Unauthenticated SSRF in SonicWall SMA1000 Appliances
published Jul 14, 2026SonicWall SMA1000 Appliances (SMA 6210 firmware)KEVRansomwarePoC
CVE-2026-908216%9.8
Actively Exploited SQL Injection in Drupal Core
published May 20, 2026Drupal CoreKEV
CVE-2026-6303011%9.8
WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
published Jul 17, 2026WordPress CoreKEVPoC ×6
CVE-2026-422086%9.3
SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild
published May 8, 2026BerriAI LiteLLM (proxy server / AI gateway)KEVPoC

Appears with

FortiClient EMSproduct · 3
The Gentlementhreat actor · 3
SOCRadarorganization · 3
Ghost C2malware · 2
OpenCodeproduct · 2
Claude Opus 4.6ai model · 2
OpenRouterorganization · 2
Phantommalware · 2
SimpleHelpvendor · 2
INCthreat actor · 2
Kimi K3ai model · 2
cPanelvendor · 2
Fortinetvendor · 2
SonicWallvendor · 1
INC Ransomwarethreat actor · 1
cPanel/WHMproduct · 1

Entities are extracted by the model from each article. First seen Oct 21, 2026, last mentioned 2d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.