SOCRadar says ransomware affiliates ran intrusions through OpenCode on mainstream models

The threat-intelligence firm SOCRadar says a single exposed command-and-control server let it read the AI session logs of ransomware affiliates working with two groups, INC Ransomware and The Gentlemen. Its write-up, published on 20 October, describes intrusions planned and run through an open-source coding agent with a human approving each step. It is the second report from SOCRadar this month on criminals using agentic coding tools, after CyberXero and Claude Code.

What SOCRadar says it found

• The AI stack. The operators used OpenCode as the interface, with models reached through OpenRouter. SOCRadar names anthropic/claude-opus-4.6 and moonshotai/kimi-k3. It analyzed 8,257 messages across 133 sessions and says recorded API spending passed $23,920.
• Commercial models, with a “WormGPT” costume. SOCRadar says the models were standard commercial ones; “WormGPT” was only a persona prompt and a label on 32 MCP servers wired to the operators’ tools. When a model refused, it says, the operator rewrote the request as an “Authorized Red Team Assessment Request” rather than switching models.
• A human in the loop. Each campaign began with a victim-specific prompt, and the AI waited for approval before every step under the instruction “coordinate every action with me”.
• Staged ransomware. The servers held 46 custom INC encryptor builds for six victims, packed for 1 October. SOCRadar says deployment against those targets is unconfirmed, though a 30 September screenshot shows encryption running on one victim machine.
• A shared workbench. SOCRadar rates a formal alliance between the two groups as low confidence, and a shared operating environment as moderate to high.

SOCRadar does not say whether OpenRouter, Anthropic or Moonshot were told, and we found no statement from any of them. SOCRadar says the models were reached through OpenRouter; it does not say which upstream provider served them. We are not repeating victim names or technical indicators.

What to do with it

The entry points SOCRadar lists, per the operators’ own records, are familiar: FortiClient EMS, SimpleHelp and cPanel flaws, plus VPN gateways. Its advice is the usual list done properly: patch those products, take management interfaces off the internet, look for admin accounts you did not create and modified VPN connection scripts, put MFA on remote-management tools, and keep backups out of reach.

Why it matters

The detail worth noting is the refusal workaround. If SOCRadar’s reading is right, relabelling a request as an authorized assessment was how the operator got mainstream models past their refusals, and the logs the agent kept became the evidence trail that exposed the operation. Both points are SOCRadar’s interpretation of material only it has seen in full.