SOCRadar page on INC and Gentlemen ransomware lacks article text
Original title: INC and The Gentlemen Ransomware: Exposed AI Infrastructure
The extract is site navigation plus a banner claiming stolen AI logins, not the ransomware report.
The SOCRadar item is titled as a report on INC and The Gentlemen ransomware and exposed AI infrastructure. The supplied text is navigation, product marketing and a banner stating that more than 80,000 organizations had AI logins stolen across 88 platforms and 3 billion credential records. No victims, dates, IOCs or incident narrative appear in the extract.
Unconfirmed: The article body is missing from the extract, so the ransomware claims cannot be verified from this text.
- The banner claims 80,000-plus organizations and 88 AI platforms.
- It also claims 3 billion stolen credential records.
- Those figures are promotional copy, not corroborated in the extract.
- Threat actors
- INCThe Gentlemen
- Organizations
- SOCRadar
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 2fsocradar.io | omware%3A%20Exposed%20AI%20Infrastructure%20-%20https%3A%2F%2Fsocradar.io%2Fblog%2Finc-gentlemen-ransomware-ai-infrastructure%2F "Sum |
| ipv4 | 138.124.113.210 | 89.185.83[.]8 Ghost C2 and credential harvesting tooling 138.124.113[.]210 Ghost C2 control panel 77.110.109[.]248 RevSocks revers |
| ipv4 | 179.60.149.68 | Windows VM, SimpleHelp console and staged INC encryptors 179.60.149[.]68 Staging and network pivot node 89.185.83[.]8 Ghost C2 a |
| ipv4 | 45.227.254.43 | igation began with an exposed command-and-control server at 45.227.254[.]43, whose open directories held the operators’ knowledge bas |
| ipv4 | 45.227.254.45 | penCode history, Phantom source and per-victim workspaces 45.227.254[.]45 Development and deployment hub: partner package, C2 build |
| ipv4 | 45.227.254.84 | deployment hub: partner package, C2 builds and case data 45.227.254[.]84 Operator workstation: Windows VM, SimpleHelp console and |
| ipv4 | 77.110.109.248 | esting tooling 138.124.113[.]210 Ghost C2 control panel 77.110.109[.]248 RevSocks reverse SOCKS5 host The operation timeline spa |
| ipv4 | 89.185.83.8 | cryptors 179.60.149[.]68 Staging and network pivot node 89.185.83[.]8 Ghost C2 and credential harvesting tooling 138.124.113[ |
From the original article
11 min read at socradar.io
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, […]
By Ameer Owda · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.