{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-35616",
    "name": "CVE-2026-35616",
    "vendor": "Not a vulnerability in OpenCode or any AI tool. Victims were reached through unpatched FortiClient EMS",
    "description": "SOCRadar published on 20 October 2026 (updated 23 October) an analysis of a publicly reachable command-and-control server that exposed a ransomware affiliate operation's AI session databases, knowledge base and the source of its Phantom framework, a modular \"Autonomous Red Team Kill Chain Framework\" with 18 skill modules, an autopilot orchestrator, and Python and Go agents that pose as Windows Update components and call back to api.iquickline[.]com. The operators drove intrusions through OpenCode using commercial models on OpenRouter, including anthropic/claude-opus-4.6 and moonshotai/kimi-k3: each campaign started from a victim-specific master prompt, the AI waited for operator approval between steps, and when a model refused, the operators reframed the request as authorized red-team work. SOCRadar analyzed 8,257 messages across 133 OpenCode sessions and about $23,920 of API spend. 62 organizations were named, 36 of them in the United States; 14 reached domain-level compromise, four reached encryption or extortion, and 46 INC encryptor builds were staged for six victims. Initial access came through edge systems, per the operators' own records CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp) and CVE-2026-41940 (cPanel/WHM).",
    "website": "https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-10-20",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-35616",
      "aliases": [
        "ti-159"
      ],
      "title": "SOCRadar: INC and The Gentlemen Ransomware Affiliates Ran Intrusions at 62 Organizations Through OpenCode and OpenRouter-Hosted Models With a \"Phantom\" Kill-Chain Framework",
      "summary": "SOCRadar published on 20 October 2026 (updated 23 October) an analysis of a publicly reachable command-and-control server that exposed a ransomware affiliate operation's AI session databases, knowledge base and the source of its Phantom framework, a modular \"Autonomous Red Team Kill Chain Framework\" with 18 skill modules, an autopilot orchestrator, and Python and Go agents that pose as Windows Update components and call back to api.iquickline[.]com. The operators drove intrusions through OpenCode using commercial models on OpenRouter, including anthropic/claude-opus-4.6 and moonshotai/kimi-k3: each campaign started from a victim-specific master prompt, the AI waited for operator approval between steps, and when a model refused, the operators reframed the request as authorized red-team work. SOCRadar analyzed 8,257 messages across 133 OpenCode sessions and about $23,920 of API spend. 62 organizations were named, 36 of them in the United States; 14 reached domain-level compromise, four reached encryption or extortion, and 46 INC encryptor builds were staged for six victims. Initial access came through edge systems, per the operators' own records CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp) and CVE-2026-41940 (cPanel/WHM).",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "agent",
      "component": {
        "name": "Not a vulnerability in OpenCode or any AI tool. Victims were reached through unpatched FortiClient EMS",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Not a vulnerability in OpenCode or any AI tool. Victims were reached through unpatched FortiClient EMS, SimpleHelp, cPanel/WHM and VPN gateways.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-20",
      "modifiedAt": "2026-10-20",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35616"
        }
      ],
      "mitigation": "Patch internet-facing FortiClient EMS, SimpleHelp, cPanel/WHM and VPN appliances, since edge exploitation was the way in. Hunt for what SOCRadar lists: Python beacons with TLS verification disabled, processes posing as Windows Update, callbacks to api.iquickline[.]com, unexpected RMM sessions, restic or rclone bulk uploads, and new privileged EMS accounts. An AI coding agent running on a server or on a host where no developer works is itself worth an alert.",
      "detectedByAnomity": true
    }
  }
}