CVE-2026-42208

Ransomware affiliates linked to the INC and The Gentlemen groups have been using an AI-driven intrusion framework called Phantom to automate and scale attacks. The operation leverages commercial AI models via OpenCode and OpenRouter, with human operators approving actions, to exploit vulnerabilities in public-facing systems such as FortiClient, SimpleHelp, cPanel, and SonicWall. The attackers achieve initial access, move laterally using tools like RevSocks and Ghost C2, escalate privileges, exfiltrate sensitive data, and prepare for ransomware deployment. At least 62 organizations were targeted, primarily in the U.S. and within industrial, healthcare, and energy sectors.