Hackers use AI framework Phantom for attacks and extortion

SOCRadar detailed a Russian-speaking group that uses an autonomous system called Phantom and commercial AI models via OpenRouter to breach FortiClient EMS, SimpleHelp, cPanel and network gateways. Humans approve each step, and ransom demands are calculated from stolen financial data. About 62 organizations were targeted, with four published on INC and The Gentlemen leak sites.

• Exploited flaws include CVE-2024-57727 in SimpleHelp, CVE-2026-35616 in FortiClient and CVE-2026-41940 in cPanel
• Attacks run through commercial AI models, with operators reframing refused requests as security audits
• Roughly 62 organizations were targeted, more than half of them in the US
• Main targets are industrial, construction, energy, healthcare and pharma firms