Threats Tagged 'leakned'

A Russian-speaking affiliate of the Gentlemen ransomware group, known as Azazel, compromised over two dozen organizations across six countries. The attacker exploited CI/CD secrets from GitLab instances and conducted a deep compromise of an AI platform using SSRF, credential decryption, and continuous data exfiltration. Azazel operated an independent leak site called LEAKNED to publish stolen data and retain all extortion proceeds. This campaign marks the first documented criminal use of AI assistant tooling via the Model Context Protocol (MCP) as a command-and-control channel. The attacker infrastructure included three nodes with over 50TB storage capacity, actively transferring approximately 6TB of victim data. Affected sectors include logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent organizations.