What Happened
The Hacker News reports SOCRadar found an open directory belonging to a Russian-speaking operator. It held 8,257 messages across 133 sessions. The operator ran a framework called Phantom, which SOCRadar describes as an autonomous red team kill chain framework. Affiliates of the INC and The Gentlemen ransomware groups used it.
The structure is AI-executed and human-approved. An operator writes a victim-specific prompt and reviews each step. OpenCode then runs the intrusion using commercial models through OpenRouter. When a model refused a request, operators reframed it as an authorized red team test. AI-managed knowledge bases tracked victims, credentials, and progress. The campaign targeted about 62 organizations, listed four on leak sites, and referenced seven CVEs, three under active exploitation. Industrial, manufacturing, and energy firms took the most hits.
Why This Matters for Canadian Organizations
More than half of the targets sat in the United States, and Canadian industrial and energy operators share the same vendors, the same exposed services, and the same supply chains. Attackers who automate reconnaissance and exploitation work faster than a small Canadian security team reviews alerts.
The speed gap is the lesson. Manual patch cycles measured in weeks give an automated attacker a wide window. Mid-sized manufacturers with thin security staff carry the most risk. Energy operators also face expectations under the proposed Bill C-26 critical cyber systems framework.
What to Do
Shrink your exposure first. Inventory every internet-facing service and patch known exploited flaws within days. Check the CISA KEV catalog weekly against your asset list.
Then shorten detection time. Alert on rapid credential use, mass file access, and new remote tools. Rehearse containment so your team isolates a host in minutes. Test offline backups and keep them off the domain. Read more in our Trends archive.
