AI Scripts, Targets, Prices: Phantom uses extortion as a line of water, but it has to be staffed at every step. Head

First of all, it's called: Phantom Something does exist, and it does run real-life invasions, but...It's not "AI." It's all automatic.I don't know.

Its true form is:AI is in charge of the proposal and the person is in charge of the nod.Each move requires the operator's approval to go down — the word is “coordinate every action with me”.

This is, on the contrary, the most worthwhile place for this article. Because Full Auto sounds scary but far away, every step sounds safe but close.A man with a bunch of AI can finish the work of a former team.

Three numbers to remember:8,257 messages / 133 sessions / AI bills $23,920I don't know. Twenty-four thousand dollars, 62 organizations.

Phantom: AI execution, nod-up extortion. Line

First, the credibility of the source is clearly defined.

There is only one source for this article:SOCradar Threat Research Team (STRU)Published 20 October 2026, updated 23rd. On October 24th, Claude Security Alliance made an analysis, but it clearly wrote:Almost all of the public details go back to SOC Radar, an analysis that is currently not independently confirmed by a second research team, model manufacturers or government agencies.

This is important because it determines how you use all the numbers behind.

The good news is the evidence is unique:Not from the outside, but from the attackers' own machine.At the end of September, 2026, a C2 server exposed to the public network. 45.227.254[.]43 The list of directories is open, which contains the knowledge base, OpenCode session database, Phantom source code and victim-by-victim workspace. Following the configuration, logs, proofs, STRU touched six more, seven more, most of which were hung on AS267784(Flyserves S.A.)

So the numbers are in two categories, and I will mark them in the text:

Verifiable: number of session bars, number of messages, account consumption, number of encryption files, source structure - these are directly from the file and have the highest credibility.
The assailant reported it.How many targets, how many passwords, how many homes have been invaded - These are the results of their own knowledge base.No one checked.It's the only thing they think.

ii. Who's this gang? What's official?

Socradar's characterization was very restrained and the three confidence levels were separated, which is worth learning:

Trust me.The hosts are active intrusion development and combat stations.
It's a big deal.Affiliated members of INC and The GentlemenShared operating environmentI don't know.
I don't believe it.There is a formal alliance between the two brands.

The most likely forms are:A supplier specializing in tools and infrastructure while serving multiple blackmail brands.

If this judgment is true, it means much more than "a gang gets stronger" --Phantom's ability is being used as a service to circulate in a blackmailing environment.And not the personal goods of a certain family. The number of people who can do it will increase.

Operator portrait:Russian, main event time 06:00–14:00 UTCI don't know. This window corresponds to Moscow time from 9pm to 17pm, a normal working person.

Three, six water lines, each with a human spot. Head

Phantom describes himself as "Autonomous Red Team Kill Chain Framework", 18 skill modules with autopilot and self-study anent (disguised as Windows Update component). Run at open source terminal OpenCode Go, go, go. OpenRouter Call it in. anthropic/claude-opus-4.6 and moonshotai/kimi-k3I don't know.

But the true way to run is six sections, each of which ends with one person:

#	Phase	AI, what?	What are you doing?
01	Target selection	Draw EMS/ SimpleHelp/ Mail/ VPN list of assets in FOFA	Confirm which fight, which order.
02	Call the entrance.	Generate and debug bug-use commands	Release, decide which path to take.
03	Step on it.	Domain count, warrant, priority of documents	Risk assessment, decision to continue
04	Pack the outside.	Write RevSocks Tunnel and Restic/ rcline Transfer Command	Confirmed no trigger.
05	Pricing	The stolen money is estimated as "how much can be paid without the bank" and as a regulatory leverage.	How much is it?
06	Encryption/Pression	Generate custom encryption configuration, blackmail letters, voice fishing scripts	I've decided not to.

The official "autonomous" is a marketing term. SocRadar's exact words are: This is the first time I've been able to talk to you.- AI execution, manual approval.

CSA gave me a reading that I thought was in place: "The artificial gate has three advantages for the operator:

Cost savings.Models create evidence, exaggerate discovery (Anthropic lit the issue in GTG-1002), and one can single out and avoid burning down an entrance.
Control OPSEC.The real victim network, when and how hard it is to be judged.
Move bottlenecks from models to people.One can stare at a few lines at the same time, approve much faster than write.

"Human-approved" is not read as "slow."133 sessions, 62 targets, and this output can be sustained by a team.

Four, the entrance's still the same. It's long overdue.

This is the least "AI" section of the whole and the most actionable section.

AI accelerated the process, butIt didn't open the door.I don't know. The attackers recorded all the entrances on the edge of the Internet (the following figures are self-reported):

CVE	Products	Results from the attackers' records
CVE-2026-3516	Fortinet FortiClitEMS authentication bypassed	2,236 targets . 108 administrator accounts . 4,140 Tenet terminal
CVE-2024-57727	SimpleHelp RMM Path Crossing	Sweeped 4,922 . Got 427 administrator passwords 242 IPs affected
CVE-2026-41940	cPanel/WHM authentication bypass	Alleged invasion of 49+ small house custodians Business
CVE-2026-15409	Sonicwall SMA1000	We've got a list of targets, not confirmed.

None of these first holes is new.Fortinet reported in April 2026 that CVE-2026-35616 had been used in the field, CISA added it to KEV on 6 April; SimpleHelp, the hole in which CISA had issued an announcement in June 2025 that a blackmailing gang was taking it for a client downstream.

Translation:These doors are open because no one's closing them.

The movement after entering is also routine: the domain count refers to the domain tube, grabs the evidence, prioritizes the finance/HR/legal/ executive file, pulls it out through the SOCKS tunnel in reverse.

Reuse is the maximum amplifier.There is a case in the report:A reused password with VPN, server, RMM, backup and security control platform opened.

Defense circumvention is by BYOVD: a Quick Heal/Seqrite killer who abused Zemana. zam64.sysI don't know. The attacker's own log shows that there's a good or bad effect on a company-level EDR -- this is real, which means that EDR is not paper, but it's not everything.

Five, how much money is spent, how much is it going to cost?

This part is the most obvious part of "AI's involvement in business judgment."

Cost end:Two payments OpenRouter accounts, one of which cost $23,920 and almost saw it after. Bottom(Required in real time on 5 October 2026). Plus seven VPS. That's it.

Pricing end, AI doing worse than writing code:Take the stolen financial data and estimate how much the company can pay if it doesn't shock banks and insurance., then find regulatory leverage (customer data, compliance obligations) as leverage.

Several cases have been documented:

Aidon.: €15 million at which the operator dropped to €4 million / €2.5 million when he discovered the wrong parent company.
Leo Schachter Diamonds: Four-part pressure mail, signed The Gentlemen, with a voice fishing script.
Trulit Glass & Aluminum: Made a counterfeit station trulitesupport[.]com"Security Incident Notification" is sent directly to the victim's client, linked to the leak page.
A medical network.24 hours, AUD 3 million to 8 million.

The rhythm of pressure is fixed: only text mail to the boss or executive,No quote.; then voice fishing; then clients and partners; then supervision; finally disclosure. Duration 24-72 hours. Payment plans are in Menrocoin, butNo wallet, no payment records., the final result is unknown.

What this section means for the defence:Your finances, your client lists, your compliance obligations are part of the attack.They decide how much they bid and whether you will pay.

VI. 62 VICTIMS, NOT QUANTIFIC

STRU divided the 62 named organizations into five groups by penetration depth:

Slot	Depth	Number
L1	Only reconnaissance.	12
L2	Get your foothold.	28
L3	Local level lost	14
L4	Entering encryption or extortion	4
L5	It's publicly hung on the leak site.	4

Geographically 36 households in the United States. Industry first.Industry/manufacture/energy 16.1%Second,Medical/pharmaceutical 14.5%I don't know.

The most telling is the distribution of revenues:Out of the 35 households that have access to the target, 27 have $250 million.

It's a typical medium-sized business portrait.Marginalized equipment is naked on the public network, IT is outsourced to MSP, does not have a test capability of 7x24, but has money on the books.And through the MSP line, a small company can be logged in.

vii. How they were extracted: the memory of AI

This section is the most ironic and valuable part of my view of the report as a whole.

This business is gonna work out.Sustainable knowledge baseThe long-term memory of AI remembers the progress of each victim, the evidence stolen, the plan for the next step. All three of them are on the server.

And that's why it flipped:Knowledge base + session log = a complete modus operandi.It has source code, supporting documents, screenshots (including the SimpleHelp screen taken by the operator on the victim's machine), internal chat records (Rocket.Chat) and a discussion on "Moscow time 6 o'clock tomorrow?"), and 46 victim-specific encryption devices.

46 encryption devices covered six victims, Windows and Linux, each with a separate key and victim identification. Three of them packed on 30 September and were ready for launch on 1 October.

The technical details of the encryption device are worth remembering: the backup, the database, the service process is stopped;Call delete copy with direct drive, do not go vssadmin;add .INC suffix;throw one INC-README.txt Point to Tor Chat Portal.

There's also evidence of an "in-house package." smilefacesec@gmail.comCross-check it with the BlackForums account. sm4l1st123I don't know.Same person, cross-platform, same identity.

They wrote to their partners. README_PARTNER.mdThe ad word is "35 MCP servers, 55+ tools, 9K+CVE PoC".This is SaaS's product description.

VIII. Lists of defences that can be directly copied

The report contains a number of recommendations, and I'm reordering them as "can we do it today?"

Today: Check if these four are exposed to the public web.

FortiCliantEMS- Especially if there's any backstage. sysadminI don't know.fct_svc_*I don't know.ems_monitor_* Such unexpected high-priority accounts; check if VPN connects scripts and configuration files have been modified.
SimpleHerp / MeshCentral / N-central This type of RMM - counts, patches, limits who uses it.
cPanel/WHM- especially the trustee and its clients.
Sonicwall SMA1000— CVE-2026-15409 has been included in the list of targets.

The management interface can be accessed online.Patches don't mean clearing the field.The attackers who are already inside will not leave for patches and will have to do a separate check.

This week: Break the "One Password"

VPN, RMM, backup, virtualization, security console, separate account number + MFA, not reuse.
Manage face-to-face IP white lists, limited.
Up, LAPS and gMSA as administrator layer (Tier 0/1/2).
The same requirement was made for MSP to write into the contract - the re-use of the MSP customer was what had happened.

Test: Check by behavior and rhythm, not just one point. Police

The following acts are named in the report and can be taken directly to the rules:

Office 进程拉起 PowerShell / curl / certutil
非域控主机发起复制请求（DCSync 特征）
卷影副本里的 ntds.dit 被读取
RC4 Kerberos 服务票据异常增多
restic / rclone 向外部对象存储批量传输
非安装器进程出现 Restart Manager 会话
zam64.sys（Zemana 驱动）加载 + Quick Heal/Seqrite 服务被停

There are two specific IOCs: planned missions. First Name RealtekAudioSvcGo back to the domain. iquickline[.]comI don't know. IP Paragraph 45.227.254.xI don't know.77.110.109.248I don't know.

Backup: No, no, no, no.

Invertable backup or offline isolation, virtualization of the mainframe and the core document server are separated from the user segment.The first thing about encryption is to stop back-up services and delete copies.It's a design goal, not a side effect.

If you're doing it yourself, Agent,

This architecture...Open Source Agent Harness + MCP Tool Server + Enduring Knowledge Base + Aligning Model- It's exactly the same structure as the decent Agent deployment in your company.

So the system of governance is also a defence:The session logs are to be kept, tools are to be called to be authorized, and the identities of intermediaries are to be traced.

There is also a model manufacturer and polymer: when the request is packaged as "Authorized Red Team Society", the request is made to the model manufacturer and the polymer.The absence of a statement of authorization to validate the context should be considered a risk rather than a confidence signal.When the attackers were rejected, it was not an open-ended model.Reword- Change the template to keep asking.

IX. Final three sentences

First sentence:Full automatic blackmail has not yet arrived, but a "one by one" team has arrived.Don't use "AI can't do it" as a comfort. It's worth not replacing people, it's turning people into bottlenecks -- bottlenecks can be magnified.

Second sentence:AI made the attack faster, but not easier.The entry points for the 62 targets, all those old holes in KEV. It's not the model that really should be anxious, it's your EMS.

Third sentence:The cost structure of this business has changed.24,000 API bills, plus 7 VPS, will support 133 sessions. When the input is down to this level, the assumption of "not fat enough for no one to fight" goes off -- 250 million-dollar medium-sized companies are in range.

They were sold by their own AI memory. It reminds everyone who is doing Agent that the knowledge base is an asset and evidence.

The last sentence left for those who worked for security: the report had only one source and independent validation had not yet taken place.Conclusions can wait, patches don't wait.