INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds

What happened

The investigation began in late September 2026 with open directories on 45.227.254[.]43. Recorded spending on one OpenRouter account reached $23,920.

Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. Configuration files and credentials led researchers to six additional adversary servers, exposing development infrastructure, command infrastructure and ransomware (software that locks up files and demands payment) staging systems.

cyber security Cyber Security News Malware 2 min.

The findings describe an active operational environment, rather than an isolated malware experiment.

Operators used OpenCode with OpenRouter-hosted models, including Claude Opus 4.6 and Kimi K3, alongside persistent knowledge bases and Phantom, an “Autonomous Red Team Kill Chain Framework.” Despite the autonomous branding, approval remained central.

Victim-specific prompts instructed AI to coordinate every action with the operator. Models planned reconnaissance, generated commands, debugged tooling, assessed stealth options and organized stolen information, while humans authorized subsequent steps.