{"schema_version":"0.10.0","id":"LR-2026-0789","record_version":1,"title":"INC and Gentlemen ransomware affiliates expose 8,257 AI messages","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Hackread · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Hackread · subject to change"}]},"sources_hash":"eb54211658acdafd1270dd835b04241913df9fd3ed9a23ffdf6bdf0f3a300819"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"OpenCode","tools_granted":[],"permissions_scope":null,"autonomy_level":"approve-each","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-21","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Researchers at SOCRadar found seven exposed servers linked to INC Ransomware and The Gentlemen ransomware affiliates. The exposed data held 8,257 AI messages across 133 OpenCode sessions, where the operators used an AI coding interface to plan reconnaissance, generate commands, analyze stolen credentials and draft reports. The session logs show that human approval was required before each step. When commercial models refused malicious requests, the operators rephrased their prompts as authorized red team templates. The records listed 46 custom INC encryptor builds prepared for six victims ahead of a planned October 1, 2026 deployment, but the report does not confirm that all six attacks took place. A September 30 screenshot showed an encryptor running on a victim workstation, which is evidence of encryption activity in at least one case. The company report was published on October 20.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK12","RK04"],"control_chain":[{"layer":"L1","party":"provider","party_name":null,"control_id":"D1","outcome":"got_around","reason":null,"quote":"When commercial models refused malicious requests, the operators rephrased their prompts as “Authorized Red Team Assessment Request” templates.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: moderate, data or systems of others touched with a bounded scope stated. Fact: an encryptor ran on a victim workstation, and encryptor builds were prepared for six victims.","harm_class":[],"affected_description":"six victims","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/","publisher":"Hackread","date":"2026-10-21","type":"press","title":"INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages - Hackread","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","system.autonomy_level":"C","event.agent_involved":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"The operators used OpenCode, an AI coding interface, alongside persistent knowledge bases to plan reconnaissance, generate commands, analyze stolen credentials and draft reports."}],"system.autonomy_level":[{"source_index":0,"quote":"The session logs show that human approval was required before each step."}],"event.agent_involved":[{"source_index":0,"quote":"The operators used OpenCode, an AI coding interface, alongside persistent knowledge bases to plan reconnaissance, generate commands, analyze stolen credentials and draft reports."}],"impact.affected_description":[{"source_index":0,"quote":"Although 46 INC encryptor builds were prepared for six victims ahead of a planned October 1, 2026, deployment, the report does not confirm that all six attacks took place."}],"event.incident_class":[{"source_index":0,"quote":"Although 46 INC encryptor builds were prepared for six victims ahead of a planned October 1, 2026, deployment, the report does not confirm that all six attacks took place."}],"impact.severity":[{"source_index":0,"quote":"A September 30 screenshot from a SimpleHelp console showed an encryptor running on a victim workstation, providing evidence of encryption activity in at least one case."}],"impact.severity_because":[{"source_index":0,"quote":"A September 30 screenshot from a SimpleHelp console showed an encryptor running on a victim workstation, providing evidence of encryption activity in at least one case."}],"event.control_chain":[{"source_index":0,"quote":"When commercial models refused malicious requests, the operators rephrased their prompts as “Authorized Red Team Assessment Request” templates."}],"event.summary":[{"source_index":0,"quote":"Cybersecurity researchers at SOCRadar recently discovered seven exposed servers linked to INC Ransomware and The Gentlemen ransomware affiliates, finding AI session logs, stolen credentials and ransomware tools among the exposed data."},{"source_index":0,"quote":"According to the company’s report, published on October 20, the SOCRadar Threat Research Unit (STRU) recovered 8,257 AI messages across 133 OpenCode sessions, along with 46 custom INC encryptor builds prepared for six victims."},{"source_index":0,"quote":"The session logs show that human approval was required before each step."},{"source_index":0,"quote":"When commercial models refused malicious requests, the operators rephrased their prompts as “Authorized Red Team Assessment Request” templates."},{"source_index":0,"quote":"Although 46 INC encryptor builds were prepared for six victims ahead of a planned October 1, 2026, deployment, the report does not confirm that all six attacks took place."},{"source_index":0,"quote":"A September 30 screenshot from a SimpleHelp console showed an encryptor running on a victim workstation, providing evidence of encryption activity in at least one case."}]},"notes_on_gaps":"Single press source (Hackread) reporting on a SOCRadar report; the report itself was not provided. The source names Claude Opus 4.6 and Kimi K3 as commercial models used by operators but does not link either to the OpenCode sessions, so no model_name or model_version is given. No developer, deployment context, lifecycle stage or intended use is stated for the system. Attack figures (49 breaches, 427 passwords, 2,236 targets and similar) come from attacker records and are unverified, so they are not recorded as values. No date of occurrence or date of detection is stated; the September 30 screenshot is recorded only as a timeline event. The $23,920 figure is AI API spending, not a loss, so no direct loss is recorded. The 62 named organizations are operator-record targets, not confirmed affected parties, so no affected count is recorded. Only one encryption instance is evidenced and the report does not confirm all six attacks happened. Judgements made: incident_class set to security_compromise; agent_involved set to true because the AI generated commands; autonomy_level set to approve-each from the stated approval requirement; adversarial_actor set to external_attacker and responsible_party to third_party for the ransomware affiliates; severity set to moderate because a victim system was touched with a bounded scope of six victims. Trigger, root cause, failure class, remediation and reversibility are not stated and were left out. The B1 link is recorded as held even though it was the operators' own control, not a safeguard on a vendor system. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Hackread · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Operators used OpenCode, an AI coding interface, with persistent knowledge bases to plan reconnaissance, generate commands, analyze stolen credentials and draft reports.","quote":"The operators used OpenCode, an AI coding interface, alongside persistent knowledge bases to plan reconnaissance, generate commands, analyze stolen credentials and draft reports.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"When commercial models refused malicious requests, operators rephrased prompts as authorized red team templates to get around the refusals.","quote":"When commercial models refused malicious requests, the operators rephrased their prompts as “Authorized Red Team Assessment Request” templates.","source_index":0,"grade":"C"},{"step":"reached","text":"The records held 46 INC encryptor builds prepared for six victims ahead of a planned October 1, 2026 deployment, though the report does not confirm all six attacks happened.","quote":"Although 46 INC encryptor builds were prepared for six victims ahead of a planned October 1, 2026, deployment, the report does not confirm that all six attacks took place.","source_index":0,"grade":"C"},{"step":"caught","text":"SOCRadar researchers found seven exposed servers linked to INC and The Gentlemen affiliates.","quote":"Cybersecurity researchers at SOCRadar recently discovered seven exposed servers linked to INC Ransomware and The Gentlemen ransomware affiliates, finding AI session logs, stolen credentials and ransomware tools among the exposed data.","source_index":0,"grade":"C"},{"step":"done","text":"The records described an extortion strategy built on stolen financial and business data.","quote":"The records also described an extortion strategy built around stolen financial and business data, with threats to contact victims’ customers, partners and regulators.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/"]},"analysis":{"sections":{"timeline":[{"text":"Screenshot shows an encryptor running on a victim workstation.","quote":"A September 30 screenshot from a SimpleHelp console showed an encryptor running on a victim workstation, providing evidence of encryption activity in at least one case.","source_index":0,"when":"September 30"},{"text":"Planned deployment date for 46 INC encryptor builds prepared for six victims.","quote":"Although 46 INC encryptor builds were prepared for six victims ahead of a planned October 1, 2026, deployment, the report does not confirm that all six attacks took place.","source_index":0,"when":"October 1, 2026"},{"text":"SOCRadar report published, recovering 8,257 AI messages across 133 OpenCode sessions.","quote":"According to the company’s report, published on October 20, the SOCRadar Threat Research Unit (STRU) recovered 8,257 AI messages across 133 OpenCode sessions, along with 46 custom INC encryptor builds prepared for six victims.","source_index":0,"when":"October 20"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/"]}}