Researchers recovered 8,257 AI chat messages, with healthcare and pharmaceutical organizations making up 14.5% of the named targets.

 

What happened

Researchers found seven exposed servers linked to affiliates of the INC and The Gentlemen ransomware groups, holding AI session logs, stolen credentials, and ransomware tools, Hackread reported on October 21, 2026. An affiliate is a criminal who rents a ransomware group's tools and carries out attacks in exchange for a share of the ransom. The researchers recovered 8,257 AI messages across 133 sessions, along with 46 custom INC encryptor builds prepared for six victims. The operators' records named 62 organizations, 36 of them in the United States, and healthcare and pharmaceutical organizations made up 14.5% of the listed targets. The records also described plans to pressure victims by contacting their customers, partners, and regulators, using stolen financial and business data.

 

Going deeper

The operators used an AI coding tool connected to commercial models, including Claude Opus 4.6 and Kimi K3, to plan reconnaissance, generate commands, analyze stolen credentials, and draft reports. Their records showed more than $23,920 spent on AI services. The session logs show a person had to approve each step, and one instruction told the AI to "coordinate every action with me." When the commercial models refused malicious requests, the operators reworded their prompts as authorized red team assessment requests, which are the security tests companies hire people to run against their own systems. The encryptor builds were prepared for a planned October 1 deployment, though the research does not confirm all six attacks took place. A September 30 screenshot showed an encryptor running on at least one victim's workstation.

 

What was said

The operators’ records claimed large numbers of compromised systems through flaws in internet-facing products, including more than 49 hosting providers breached through a cPanel vulnerability and 427 administrator passwords obtained from scans of SimpleHelp remote support servers, Hackread reported. Hackread noted these figures come from the attackers’ own records and have not been independently verified. The researchers also said they could not confirm that all six planned attacks took place.

 

In the know

Both groups were among the most active this year. Of the ransomware incidents in August that could be linked to a known group, 116 were attributed to The Gentlemen and 43 to INC Ransom, Infosecurity Magazine reported from NCC Group's data. That month set a 2026 record, with more than 1,000 organizations hit by ransomware worldwide. The Gentlemen and Qilin traded places throughout the year as the most prolific group. In the INC and Gentlemen operation, the human approval step shown in the logs matters, because it means the AI was speeding up work the operators still directed rather than running attacks on its own.

 

The big picture

The AI tools in these logs were used to exploit the same unpatched remote access products that have hit healthcare and its suppliers before, which puts the defensive weight on patching rather than on detecting AI. CISA warned that ransomware actors had been exploiting the same SimpleHelp vulnerability since January 2025, including to reach the customers of a software provider through its unpatched copies, according to its advisory. CISA noted the vulnerable software can be running directly or built into third-party products, so an organization may have it without knowing. Healthcare organizations can ask their IT providers and vendors whether SimpleHelp, FortiClient EMS, or cPanel are in use anywhere in their environment and whether those systems are fully updated.

 

FAQs

Did the AI carry out the attacks on its own?

No. The logs show a person approved each step, and the AI was used to plan, generate commands, and draft reports.

 

How did the attackers get around AI safety refusals?

They reworded malicious requests to look like authorized security testing, according to the research.

 

Were healthcare organizations targeted?

Healthcare and pharmaceutical organizations made up 14.5% of the 62 named targets in the operators' records.

 

Are the attackers' claimed breach numbers reliable?

They come from the attackers' own records and haven't been independently verified.

 

What should organizations check?

Whether SimpleHelp, FortiClient EMS, or cPanel are in use, including inside vendor products, and whether they're patched against known exploited vulnerabilities.