Ransomware Affiliates INC and The Gentlemen Exposed After Operational Security Failure Reveals AI-Powered Attack Infrastructure

Researchers uncovered exposed servers belonging to INC and Gentlemen ransomware affiliates in late September 2026, exposing years of AI-assisted operational plans, stolen data, and attack tools. Security researchers from SOCRadar's Threat Research Unit discovered seven publicly accessible servers operated by the ransomware groups, following a misconfiguration that left critical infrastructure exposed. The breach revealed an unprecedented window into how modern ransomware operators leverage commercial AI models to automate reconnaissance, credential theft, and attack coordination.