Research reportsSOCRadar Threat Research Unit

SOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process

SOCRadar analyses exposed attacker infrastructure, describing an intrusion workflow in which humans make and approve decisions while AI assists execution. The research highlights continued risks from remote entry points, reused passwords and backup administration privileges. Listed targets should not all be treated as successful extortion victims.

Anti-Ransomware · Compiled with SI agent assistanceOriginal advisory and subsequent updates:Checked 2026.10.26
Original synthetic illustration of incident response colleagues checking an event timeline and system access
Illustration · Source ↗ · About this image ↗

Source Facts

SOCRadar published its research on 20 October and updated it on 23 October, analysing tools and conversation logs left by attackers. The team assesses that operators used AI to help plan and execute tasks, while humans still selected targets and approved steps.

The research records for 62 organisations cover different stages, including reconnaissance, initial access and extortion; they are not 62 confirmed successful extortion incidents. Evidence of a formal alliance between the groups is also limited. This article summarises researchers' observations without treating every attacker claim as fact.

The report's defensive priorities still include patching internet-facing devices, limiting remote administration tools, separating privileged accounts, and isolating and testing backups. AI involvement does not make these basic defences ineffective.

Next Steps for Businesses / Editorial Observations

Controlling elevated privileges, remote tools and data exfiltration addresses the risks described in the research better than blocking a particular AI brand alone.

Next steps you can take

  • Inventory internet-facing and remote administration entry points, prioritise patching and restrict access to management interfaces.
  • Eliminate reused administrator passwords across systems, and verify backup isolation and alerts when protection tools are disabled.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

INC and The Gentlemen Ransomware: Exposed AI Infrastructure

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMIllustration of separated network cables and ports on a workbench, representing isolation checksIllustrationSI Agents · 2026.10.23

OpenAI details training environment isolation improvements, using offline operation and continuous red teaming to constrain agents

OpenAIOriginal synthetic illustration of a conceptual installation showing automated payment tokens and a separate approval boundaryIllustrationSI Agents · 2026.10.22

x402 research exposes automated payment risks: agents need clear spending limits

V12 / x402 Foundation