Inside the Gentlemen Ransomware Affiliate’s Operation

The threat actor Azazel, a Russian-speaking affiliate of the Gentlemen ransomware group, conducted a multi-faceted ransomware and data theft campaign. Using stolen CI/CD secrets from GitLab instances, including tokens that crossed organizational boundaries, Azazel gained access to victim networks. He registered a reverse shell as a tool inside an AI coding assistant and used the MCP protocol as a command and control channel, a novel operational technique not previously publicly reported. Azazel operated a three-node infrastructure: a victim-facing C2 and open directory server, a staging server with 29TB of storage for operational scripts and active exfiltration, and a long-term archive server with 22TB of stolen data. Victims spanned sectors including logistics, insurance, pharmaceuticals, AI, medical devices, and government-adjacent infrastructure. Azazel also ran his own leak site, LEAKNED, to publish stolen data and collect extortion payments independently of the main ransomware group, effectively betraying both victims and the ransomware operator. The investigation revealed active data exfiltration during the analysis and included coordinated victim notifications and TLP:RED disclosures.

The operation resulted in the compromise of over two dozen organizations across six countries, with approximately 6TB of data stolen and more than 50TB of infrastructure dedicated to the attack and storage of stolen data. Victims included critical sectors such as AI companies, logistics, insurance, pharmaceuticals, and government-adjacent entities. The actor bypassed the ransomware group's revenue sharing by independently publishing victim data and collecting ransom payments. The use of stolen CI/CD secrets and GitLab tokens allowed broad lateral movement and access. The novel use of MCP as a C2 channel and AI assistant tooling demonstrates advanced operational capabilities. Active exfiltration was observed during the investigation, indicating ongoing risk to affected organizations.

Coordinated victim notification was conducted prior to public disclosure, and TLP:RED technical details were shared with affected organizations. Organizations should review and rotate all CI/CD secrets, GitLab tokens, and related credentials to prevent unauthorized access. Monitoring for exposed or misconfigured storage servers and open directories is critical to avoid inadvertent data exposure. Given the novel use of MCP as a C2 channel, network defenders should consider monitoring and restricting MCP protocol traffic, especially on loopback and exposed ports. Since the threat actor exploited stolen secrets and misconfigurations, securing CI/CD pipelines and implementing strict access controls are recommended. No official patch or fix applies as this is an operational compromise scenario. Organizations should consult the detailed CloudSEK report and indicators of compromise for tailored detection and response.