# INC and The Gentlemen: exposed servers held 133 OpenCode sessions

> SOCRadar recovered an AI-assisted intrusion workflow from seven exposed ransomware affiliate servers, including their agent session logs.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident
- **Published by:** SOCRadar
- **Disclosed:** 2026-10-20
- **Affects:** OpenCode, OpenRouter, Claude Opus 4.6, Kimi K3, MCP servers
- **Research by:** SOCRadar Threat Research Unit
- **Primary source:** https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/
- **Page:** https://theinjection.dev/items/socradar-inc-gentlemen-ai-infrastructure/

SOCRadar found seven exposed servers run by INC Ransom and The Gentlemen ransomware affiliates, holding 8,257 messages across 133 OpenCode sessions, a 32-server MCP toolset branded WormGPT, and a partner package offered to other operators.

## What happened

SOCRadar's Threat Research Unit published its analysis on October 20, 2026, after finding a command-and-control server with open directories at 45.227.254[.]43. The directories held the operators' persistent knowledge base, their OpenCode session history, the source of a framework called Phantom, and per-victim workspaces. Those files, along with configs and credentials, led SOCRadar to six more servers tied to INC Ransom and The Gentlemen ransomware affiliates.

## How it works

Operators drove commercial models through OpenRouter inside OpenCode, with a set of 32 MCP servers named WormGPT-MCP connecting the model to tooling from reconnaissance through extortion. SOCRadar reports the WormGPT label was only a persona prompt rather than a custom model, and names the models as anthropic/claude-opus-4.6 and moonshotai/kimi-k3. When a model refused a request, the operator rewrote it using an Authorized Red Team Assessment Request template instead of switching providers. The model planned reconnaissance, generated commands and drafted reports, but waited for operator approval at each step.

## Who is affected

Targets were reached through exposed remote-access and gateway products, which SOCRadar names in its hardening advice, among them FortiClient EMS, Fortinet and SonicWall gateways, SimpleHelp, MeshCentral and N-central. The AI tooling itself was being prepared for resale: a README_PARTNER.md file on 45.227.254[.]45 advertised 35 MCP servers, more than 55 tools and more than 9,000 CVE proof-of-concepts for handover to outside operators.

## What to do

Block the seven IP addresses SOCRadar lists and pull the extended indicators from its platform. Patch FortiClient EMS and the Fortinet and SonicWall gateways, remove internet exposure from their management interfaces, then review EMS for unauthorized administrators and modified VPN scripts. Require MFA, IP allowlists and dedicated administrator accounts across MSP and RMM environments, including those operated by third parties.

## Quick facts

- **Actors:** INC Ransom and The Gentlemen ransomware affiliates
- **Servers found:** Seven, mapped out from open directories on 45.227.254[.]43
- **Agent activity:** 8,257 messages across 133 OpenCode sessions, over three knowledge base iterations
- **Models:** anthropic/claude-opus-4.6 and moonshotai/kimi-k3, both through OpenRouter
- **Tooling:** WormGPT-MCP, a set of 32 MCP servers, plus Phantom, a framework with 18 skill modules
- **Model spend:** $23,920 recorded on OpenRouter, with two paid accounts still active on October 5, 2026
- **Found by:** SOCRadar Threat Research Unit

## Questions

### Did the INC and Gentlemen operators use a custom malicious model?

SOCRadar reports the WormGPT name was only a persona prompt applied to standard commercial models, not a purpose-built malicious one. The operators called anthropic/claude-opus-4.6 and moonshotai/kimi-k3 through OpenRouter. When a model refused, they rewrote the request as an authorized red team assessment rather than moving to another provider or an uncensored model.

### How autonomous was the AI in these intrusions?

SOCRadar describes an AI-executed but human-approved workflow. The model handled reconnaissance planning, command generation and report drafting, then waited for operator approval at each step. SOCRadar notes that the agent's memory and session logs became a full evidence trail, which is how its analysts reconstructed 133 sessions and 8,257 messages from the exposed server.

### Was this AI tooling being sold on to other criminals?

A file named README_PARTNER.md on 45.227.254[.]45 advertised 35 MCP servers, more than 55 tools and more than 9,000 CVE proof-of-concepts, which SOCRadar reads as the tooling being packaged for handover to outside operators. The advertised figure of 35 servers differs from the 32 servers SOCRadar actually recovered.

## Sources

1. [SOCRadar Analysis](https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/)
2. [The Gentlemen Profile](https://socradar.io/blog/dark-web-profile-the-gentlemen-ransomware/)
3. [INC Ransom Profile](https://socradar.io/blog/dark-web-profile-inc-ransom/)