TLDR Tech / Practical
Gentlemen ransomware affiliate steals data via GitLab, double-crosses RaaS operator
CloudSEK investigators have identified a Russian-speaking affiliate of the Gentlemen ransomware group, named Azazel, who exfiltrated data from over twenty organizations in six nations by exploiting compromised GitLab CI/CD credentials. Azazel reportedly betrayed his ransomware-as-a-service provider by publishing the stolen information on a separate leak site, LEAKNED, and keeping the profits. The investigation revealed a complex three-server infrastructure, the use of a Model Context Protocol (MCP) server for command and control, and extensive access to a significant AI platform.
Read the full story