Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Cybersecurity researchers uncovered a Russian-speaking ransomware affiliate group using an AI-driven intrusion framework called Phantom to automate attacks exploiting multiple vulnerabilities in edge and remote-access systems. The AI executes intrusion steps based on human-provided prompts, targeting systems like FortiClient EMS and cPanel, with extensive logging revealing thousands of AI-managed sessions. The attackers use credential reuse and lateral movement to exfiltrate sensitive data and部署