Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
50 IOCs
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
Malware Families
Excerpt
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom , a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that server led STRU to six more exposed…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(7)
Victim
Indicators of Compromise
Open the mindmap →50 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 179.60.149.68 | High | Score 58/100 | First seen |
| IP | 45.227.254.84 | High | Score 58/100 | First seen |
| SHA256 | ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4 | High | Score 86/100 | First seen |
| CVE | CVE-2020-1472 | Medium | Score 61/100 | First seen |
| CVE | CVE-2021-1675 | Medium | Score 42/100 | First seen |
| Domain | mcgrawney.com | High | Score 74/100 | First seen |
| Domain | system-strategy.org | High | Score 74/100 | First seen |
| CVE | CVE-2026-0300 | High | Score 72/100 | First seen |
| SHA256 | 7ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20 | High | Score 86/100 | First seen |
| CVE | CVE-2026-35616 | High | Score 58/100 | First seen |
| Domain | z26qmezqaixjp3k6spvdpool4us6m3ei453f7wgl7gouojmp2ttkdgad.onion | High | Score 74/100 | First seen |
| Domain | cloud-update.live | High | Score 74/100 | First seen |
| CVE | CVE-2024-57727 | Medium | Score 57/100 | First seen |
| SHA256 | ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918 | High | Score 86/100 | First seen |
| IP | 77.110.109.248 | High | Score 58/100 | First seen |
| CVE | CVE-2025-62215 | Medium | Score 51/100 | First seen |
| SHA256 | 0ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5 | High | Score 86/100 | First seen |
| CVE | CVE-2025-49113 | Medium | Score 56/100 | First seen |
| CVE | CVE-2023-27532 | Medium | Score 58/100 | First seen |
| IP | 89.185.83.8 | High | Score 58/100 | First seen |
| CVE | CVE-2025-59718 | Medium | Score 59/100 | First seen |
| Domain | incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion | High | Score 74/100 | First seen |
| Domain | trulitesupport.com | High | Score 74/100 | First seen |
| Domain | driverupdate.app | High | Score 74/100 | First seen |
| Domain | incadmd42ytgp4hwkejirji4m6pcbacazoeic7fc5sd27nr7it5ajyqd.onion | High | Score 74/100 | First seen |
| IP | 45.227.254.43 | High | Score 58/100 | First seen |
| Domain | incblog4uttkxd6b4grii6k2qcj2tn5k37seep5xto3dlghyqla7u7qd.onion | High | Score 74/100 | First seen |
| CVE | CVE-2026-41940 | High | Score 77/100 | First seen |
| CVE | CVE-2025-66568 | Medium | Score 51/100 | First seen |
| CVE | CVE-2024-49112 | Medium | Score 51/100 | First seen |
| SHA256 | 14b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212 | High | Score 86/100 | First seen |
| CVE | CVE-2026-42208 | Medium | Score 57/100 | First seen |
| CVE | CVE-2025-66567 | Medium | Score 51/100 | First seen |
| SHA256 | 4286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885a | High | Score 86/100 | First seen |
| SHA256 | ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb | High | Score 86/100 | First seen |
| Domain | bossprotect.com | High | Score 74/100 | First seen |
| SHA256 | ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463e | High | Score 86/100 | First seen |
| CVE | CVE-2026-41089 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-63030 | High | Score 78/100 | First seen |
| Domain | api.iquickline.com | High | Score 58/100 | First seen |
| Domain | incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion | High | Score 83/100 | First seen |
| CVE | CVE-2026-15409 | High | Score 78/100 | First seen |
| Domain | incblog.su | High | Score 74/100 | First seen |
| Domain | stackpathcloud.com | High | Score 74/100 | First seen |
| IP | 138.124.113.210 | High | Score 58/100 | First seen |
| CVE | CVE-2021-42278 | High | Score 62/100 | First seen |
| CVE | CVE-2026-9082 | High | Score 61/100 | First seen |
| IP | 45.227.254.45 | High | Score 58/100 | First seen |
| SHA256 | 70f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82 | High | Score 86/100 | First seen |
| Domain | iquickline.com | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…