Researchers detail AI-driven intrusion tools used by ransomware and state actors

· Cybersecurity

Cybersecurity researchers uncovered an artificial intelligence-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups, centered on a framework called Phantom, described as an "Autonomous Red Team Kill Chain Framework." The actor behind it is assessed to be Russian-speaking, and exposed infrastructure revealed how the affiliates used AI agents to execute intrusions. Separately, researchers reported that a China-linked state-sponsored group used an AI penetration-testing tool called Artex in attacks on ConnectWise, targeting hundreds of organizations and gaining privileged access to some environments. Together the findings show AI being operationalized on both criminal and espionage sides of intrusion work.

Why it matters：AI agents are moving from experiment to operational tool for both ransomware crews and state hackers, raising the speed and scale defenders must match.

Key points

  • The ransomware-linked framework is called Phantom
  • A China-linked group used the Artex AI pentest tool against ConnectWise
  • Hundreds of organizations were targeted, with privileged access gained in some

Sources (original reporting)

More stories from this day