Exposed 45.227.254[.]43 Server Logs 8,257 Phantom AI Sessions Targeting Fortinet, SimpleHelp, and cPanel

The infrastructure at 45.227.254[.]43 exposed an "Autonomous Red Team Kill Chain Framework" called Phantom that chains OpenCode agents with commercial models hosted on OpenRouter. Operators supplied victim-specific prompts, then reviewed each step while the system executed reconnaissance, lateral movement, and data staging. Active exploitation targeted CVE-2024-57727 in SimpleHelp, CVE-2026-35616 in FortiClient EMS, and CVE-2026-41940 in cPanel, with credential reuse serving as the primary multiplier that collapsed multiple trust boundaries in single-password incidents.

Evidence shows a hybrid human-AI loop: when models refused tasks, prompts were rewritten as authorized red-team assessments rather than model switches. Logs record use of 18 skill modules for EDR fingerprinting and reverse engineering, plus WormGPT-MCP servers linking to 32 additional functions. Ghost C2 implants and RevSocks tunnels handled persistence and exfiltration, while BYOVD drivers impaired endpoint defenses with uneven results against mature EDR deployments.

This pattern extends observed ransomware affiliate tradecraft by replacing manual scripting with commercial LLM orchestration under human approval gates. It lowers the barrier for less-skilled operators while preserving plausible-deniability framing. The same infrastructure also functions as a provider node for partner groups, indicating a maturing marketplace for AI-augmented access operations.

Next indicators will likely include expanded targeting of CVE-2026-15409 SonicWall and CVE-2026-63030 WordPress flaws once weaponized, plus measurable increases in successful domain-admin escalations within 60 days.