SOCRadar’s Threat Research Unit just published a detailed breakdown of an AI-driven ransomware operation run by affiliates of INC Ransomware and The Gentlemen Ransomware groups. The attackers exploited edge devices at scale — FortiClient EMS, SimpleHelp, cPanel — to gain initial access, then moved laterally and deployed ransomware encryptors across victim networks.
The operation was sophisticated. The attackers used AI-managed knowledge bases to track victims and campaign progress, spent over $23,000 on commercial AI models to automate intrusion workflows, and staged 46 custom INC encryptor builds for an October 1, 2026 deployment wave. SOCRadar recovered the entire operation: source code, credentials, AI session logs, and evidence of live encryption on a victim workstation.
But for all that sophistication, the attack still required doing something very simple: writing files to disk on Windows systems.
The Attack Chain
The operators gained initial access by exploiting public-facing edge devices. According to their own records:
- FortiClient EMS (CVE-2026-35616): 2,236 targets, 108 created admin accounts, 4,140 managed endpoints. The attackers planted backdoor admins and pushed payloads to endpoints through modified VPN connection scripts.
- SimpleHelp (CVE-2024-57727): Scans of 4,922 servers yielded 427 admin passwords, with 242 unique IP addresses impacted. Stolen MSP technician credentials opened access to every client those technicians managed.
- cPanel (CVE-2026-41940): 49+ claimed breaches of small hosting providers, used as a springboard to the email and webmail servers they host.
Once inside, the attackers moved laterally, escalated privileges, and staged ransomware deployment. SOCRadar found 46 INC encryptor binaries built for six victims and packed for an October 1 deployment. A September 30 screenshot from a compromised SimpleHelp console shows live encryption on a victim workstation.
Every step in that chain — from initial payload delivery to final encryption — is a file operation.
Where FileSure Would Have Intervened
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file operations before they complete. You define what’s allowed. Everything else is blocked.
The most upstream intervention is at payload delivery. When the attackers pushed malicious files to managed endpoints through compromised VPN connection scripts or SimpleHelp remote access, those files had to be written to disk before they could execute. FileSure would have intercepted those write operations.
A simple rule configuration:
- File name filter:
*.exe, *.dll, *.bat, *.ps1, *.vbs - Program name filter: Authorized deployment tools only (e.g., your legitimate RMM agent)
- Operations: Write, Create
- Drive type: Hard drives
- Result: Block and alert
Unauthorized programs — including compromised VPN clients, remote access tools, or backdoor admin accounts — cannot write executable files to the system. The payload never lands. The encryptor never executes. The attack stops there.
If the payload does land, FileSure’s bulk encryption detection rule provides a second line of defense. Ransomware that begins mass-encrypting files triggers a threshold rule that detects the bulk modification pattern and blocks further encryption:
- File name filter:
*(all files) - Operations: Write, Rename/Move
- Drive type: Hard drives, Network drives, Removable drives
- Threshold: 20 matches within 60 minutes
- Result: Normal file save operations pass without restriction. Ransomware encryption events — which modify hundreds of files per minute — cross the threshold within seconds. Subsequent operations are blocked. Damage is contained to the files modified before the threshold fired.
Why This Matters
The attackers in this case spent $23,920 on AI to automate reconnaissance, tool selection, command generation, and data triage. They built custom frameworks, exploited zero-days, and compromised hundreds of organizations across 62 named victims.
But all of that sophistication still requires writing files to disk on Windows systems. If the executable can’t land, the attack stops there.
FileSure doesn’t try to recognize the threat. It doesn’t rely on signatures, behavior analysis, or AI-driven detection. It simply controls what programs are allowed to do to your files. A ransomware variant from this morning is stopped the same way as one from five years ago.
No signature update required. No waiting for your vendor to catch up. Works even when you’re offline or disconnected from your management server.
Ready to see how it works? Start a free 21-day trial at bystorm.com — full functionality, no credit card required.
Source: INC and The Gentlemen Ransomware: Exposed AI Infrastructure
Category: Ransomware
Tags: inc ransomware, the gentlemen ransomware, fortinet cve-2026-35616, simplehelp cve-2024-57727, cpanel cve-2026-41940, kernel filter driver, file system security, payload blocking
