CVE-2026-35616: SOCRadar: INC and The Gentlemen Ransomware Affiliates Ran Intrusions at 62 Organizations Through OpenCode and OpenRouter-Hosted Models With a "Phantom" Kill-Chain Framework

SOCRadar published on 20 October 2026 (updated 23 October) an analysis of a publicly reachable command-and-control server that exposed a ransomware affiliate operation's AI session databases, knowledge base and the source of its Phantom framework, a modular "Autonomous Red Team Kill Chain Framework" with 18 skill modules, an autopilot orchestrator, and Python and Go agents that pose as Windows Update components and call back to api.iquickline[.]com. The operators drove intrusions through OpenCode using commercial models on OpenRouter, including anthropic/claude-opus-4.6 and moonshotai/kimi-k3: each campaign started from a victim-specific master prompt, the AI waited for operator approval between steps, and when a model refused, the operators reframed the request as authorized red-team work. SOCRadar analyzed 8,257 messages across 133 OpenCode sessions and about $23,920 of API spend. 62 organizations were named, 36 of them in the United States; 14 reached domain-level compromise, four reached encryption or extortion, and 46 INC encryptor builds were staged for six victims. Initial access came through edge systems, per the operators' own records CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp) and CVE-2026-41940 (cPanel/WHM).

You are affected if you run Not a vulnerability in OpenCode or any AI tool. Victims were reached through unpatched FortiClient EMS, SimpleHelp, cPanel/WHM and VPN gateways..

Patch internet-facing FortiClient EMS, SimpleHelp, cPanel/WHM and VPN appliances, since edge exploitation was the way in. Hunt for what SOCRadar lists: Python beacons with TLS verification disabled, processes posing as Windows Update, callbacks to api.iquickline[.]com, unexpected RMM sessions, restic or rclone bulk uploads, and new privileged EMS accounts. An AI coding agent running on a server or on a host where no developer works is itself worth an alert.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a vulnerability in OpenCode or any AI tool. Victims were reached through unpatched FortiClient EMS and which version, then enforce a policy on it.