Caught in 4K: The Gentlemen Files

The threat actor Azazel, affiliated with the Gentlemen ransomware group, conducted a multi-country campaign compromising over two dozen organizations. Attack vectors primarily involved exploiting CI/CD secrets from GitLab instances and a sophisticated compromise of an AI platform through SSRF vulnerabilities, credential decryption, and continuous exfiltration of object storage data. Azazel deployed an independent leak site named LEAKNED to publish stolen data and retain extortion payments, effectively betraying the original RaaS operator. Notably, this campaign represents the first known criminal use of AI assistant tooling operationalized via the Model Context Protocol (MCP) as a command-and-control mechanism. The attacker infrastructure consisted of three nodes with a combined storage capacity exceeding 50TB, with about 6TB of victim data actively transferred during investigations. Victims spanned multiple critical sectors including logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent entities.

The campaign resulted in significant data exfiltration and double-extortion ransomware attacks against diverse sectors. The use of stolen CI/CD secrets and AI platform compromises enabled deep infiltration and persistent data theft. The deployment of an independent leak site allowed the attacker to control extortion proceeds, increasing financial impact on victims. The novel use of AI assistant tooling for command-and-control may indicate evolving attacker capabilities and complexity.

No specific patch or remediation guidance is provided in the available data. Organizations should review and secure CI/CD secrets, particularly in GitLab instances, and assess AI platform security for SSRF vulnerabilities and credential protection. Monitoring for indicators such as the IP 66.179.30.155 and domain forgitlab.com may assist in detection. Given the lack of vendor advisories or patches, patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.