Case inc-gentlemen-claude-exposed-serversAI-assisted malwareWorldwide
INC and The Gentlemen ransomware affiliates expose AI session logs (Claude, Kimi) and 46 INC encryptor builds on open servers
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor builds. Operators used OpenCode with OpenRouter-hosted models including Claude Opus 4.6 and Kimi K3, and reframed refused requests as authorized security assessments. Humans approved the AI's steps, and SOCRadar could not confirm that the staged encryptors were deployed. Researchers began investigating in late September 2026.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 21, 2026
- Location
- Worldwide
- Target
- 62 organizations identified by SOCRadar, 36 of them in the US, with exposure ranging from reconnaissance to extortion
- Severity
- Medium
- Verification
- Reported by credible press or researchers
- Triggered by
- Affiliates operating with INC Ransomware and The Gentlemen Ransomware
- Actor type
- Criminal
- Sector
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding 8,257 AI messages across 133 sessions, source code, stolen credentials, victim workspaces and 46 victim-specific INC encryptor builds. Operators used OpenCode with OpenRouter-hosted models including Claude Opus 4.6 and Kimi K3, and reframed refused requests as authorized security assessments. Humans approved the AI's steps, and SOCRadar could not confirm that the staged encryptors were deployed. Researchers began investigating in late September 2026.
Impact: 8,257 messages and 46 malware builds exposed, giving researchers insight into the actors' AI-assisted tooling. Victim count and losses are not stated.
Who triggered it
Actor: Affiliates operating with INC Ransomware and The Gentlemen Ransomware
Attribution: Researchers link the exposed servers (open directories on 45.227.254[.]43 and six more found via configuration files and credentials) to INC and The Gentlemen affiliates.
Motive: Unknown; ransomware operations, apparently using AI to support intrusions and malware development.
How it happened
Attack vector: AI (Claude) used in the intrusion workflow; discovered via publicly accessible open directories on operational servers.
Root cause: Operators left their own infrastructure publicly accessible, exposing configuration files, credentials, AI chat logs and malware builds.
Timeline
- Reported by GBHackers
Response
Researchers investigated and published findings. No takedown or arrests are mentioned.
Current status: Under investigation
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
Cite this case
INC and The Gentlemen ransomware affiliates expose AI session logs (Claude, Kimi) and 46 INC encryptor builds on open servers. AI Threat Watch, case inc-gentlemen-claude-exposed-servers, Oct 21, 2026. https://aithreat.io/cases/inc-gentlemen-claude-exposed-servers/
Permanent link: https://aithreat.io/cases/inc-gentlemen-claude-exposed-servers/
Related cases
The same type of incident, most recent first.