Researchers uncovered an AI-assisted ransomware operation linked to affiliates of INC and The Gentlemen. After breaking into organizations through exposed remote-access systems, the group stole sensitive files and used scripted phone calls, proof samples, and threats to contact customers or regulators to pressure victims into paying.
Affiliates linked to the INC and The Gentlemen ransomware groups reportedly ran an AI-assisted intrusion and extortion operation researchers called Phantom. The attackers exploited exposed remote-access and edge systems to get into victim networks, then moved laterally to harvest credentials and collect sensitive business files. Inside victim environments, operators followed a consistent pattern: enumerate the domain, escalate privileges where possible, harvest credentials, and prioritize finance, HR, legal, and executive documents for theft.
Once data was exfiltrated, the group analyzed stolen financial records to estimate how much a victim could pay without involving a bank or insurer. They then escalated pressure using masked proof samples and scripted vishing calls, warning that customers, partners, and regulators would be notified if payment was not made within a 24 to 72 hour deadline.
Researchers found that credential reuse was a major force multiplier. In at least one case, a single reused password granted access to a VPN, servers, remote-management tools, backup systems, and security-management platforms simultaneously. This let the attackers expand their foothold quickly across multiple critical systems rather than having to breach each one separately.
The operation targeted an estimated 62 organizations, primarily in industrial, manufacturing, energy, healthcare, and pharmaceutical sectors, with more than half located in the United States. The combination of stolen data, financial analysis, and deadline-driven phone pressure created a layered extortion approach that went beyond simply encrypting files.
Organizations can reduce the impact of this type of extortion by treating any unexpected payment-demand call as a reportable incident rather than a negotiation. Staff in finance, legal, HR, and executive roles should escalate such contact immediately to established incident-response and legal processes, especially when a short deadline is given.
Limiting credential reuse across VPNs, servers, remote-management tools, backups, and security platforms is also critical, since a single reused password was reportedly enough to expand access across several critical systems at once. Restricting and monitoring access to sensitive finance, HR, legal, and executive files can further reduce the leverage available to attackers during an extortion attempt.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Vishing refers to scripted phone calls used by affiliates of the INC and The Gentlemen ransomware groups to pressure victims into paying after data theft, often including threats to notify customers, partners, or regulators.
The attackers exploited exposed remote-access and edge systems, then moved through victim networks to steal credentials and sensitive business files.
Researchers found that one reused password unlocked a VPN, servers, remote-management tools, backup, and security-management platforms, significantly increasing the attackers' reach.
Treat the call as an incident, avoid negotiating or sharing information, and escalate it immediately to the organization's legal, executive, and incident-response teams.
A caller says, “We have your company data. Your payment deadline is coming.” This is vishing, not a routine billing call. INC and The Gentlemen affiliates reportedly used exposed remote access to steal files, then scripted calls to demand payment. Here’s the tell: they show masked samples and know your finances because they stole them. Then comes a 24-to-72-hour deadline and threats to tell customers or regulators. Don’t handle that call yourself. Report any extortion contact immediately through your company’s incident-response channel.
Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…
After exploiting SonicWall SMA 1000 VPN appliances, attackers tied to INC Ransomware reportedly contacted victims directly using emails and phone calls claiming they could help with “ransomware issues.” One caller said he was “from a group of hackers,” asserted the network was compromised, and…
UNC6671 is running real-world voice phishing (vishing) campaigns where callers impersonate IT help desk staff and create urgency around “mandatory” security changes. Victims are pushed to spoofed login pages that capture passwords and MFA codes, enabling attackers to access and steal data from SaaS…
Researchers described two cybercrime operations. While one campaign focused on breaking into websites and infrastructure, a second operation (“Operation Master”) ran an automated invoice-fraud system that sent millions of messages with personalized invoice links designed to trick victims into…
A criminal actor calling itself “Ransom Busters” is emailing organizations that recently suffered ransomware incidents, claiming it hacked ransomware groups’ servers and can delete the victim’s stolen data for a $20,000–$60,000 fee. The messages ask to speak with the CEO or IT leadership and…
Google reports UNC6671 is still actively compromising organizations by calling employees and pretending to be IT helpdesk staff running an urgent security migration. Victims are pushed to visit lookalike login pages that steal passwords and MFA codes, which then enables data theft and extortion…
