The SOCRadar-exposed infrastructure shows INC and The Gentlemen ransomware affiliates using commercial AI models via OpenRouter to automate attack steps, with human operators approving each action. This isn’t autonomous; humans stayed in control.
The human-in-the-loop requirement explains why the operation was exposed. Phantom, their kill-chain framework, uses 18 skill modules but requires explicit approval before each step. The logging overhead and approval cycles created persistent evidence. A fully autonomous system might have been stealthier.
What matters is cost. The operators spent $23,920 across 8,257 messages hitting 62 organizations. When reconnaissance and exploitation automate with human checks, you don’t need expensive tools or zero-days. This mirrors exploit kits a decade ago: commodification plus cheap infrastructure. Ransomware gangs have always borrowed offensive tradecraft; now they’re borrowing from LLM APIs.
Sources: SOCRadar Threat Research Unit • Cybernews
Coverage: The Hacker News
Related on this blog: [AUTO] Agent Security and the Vendor Incentive • [AUTO] Six hours to 23,800 stolen credentials • [AUTO] AI-Orchestrated Retail Attacks Cost $25 Per Site