A Russian-speaking affiliate of the Gentlemen ransomware group, known as Azazel, compromised over two dozen organizations across six countries by exploiting CI/CD secrets from GitLab instances and conducting a deep compromise of an AI platform using SSRF, credential decryption, and continuous data exfiltration. Azazel operated an independent leak site called LEAKNED to publish stolen data and retain extortion proceeds. This campaign is notable for the first documented criminal use of AI assistant tooling via the Model Context Protocol (MCP) as a command-and-control channel. The attacker infrastructure included three nodes with over 50TB storage capacity, actively transferring approximately 6TB of victim data. Affected sectors include logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent organizations.
Between May and July 2026, security researchers deployed an unauthenticated Model Context Protocol (MCP) honeypot server to observe how threat actors exploit AI agent infrastructure. Of approximately 1,000 sources that reached the decoy, 596 spoke the protocol and 24 proceeded to actively exploit it. These operators executed 628 shell commands, 255 file reads, and 248 secrets-store lookups, with 19 hunting credentials and 4 attempting container escapes. Activity escalated from 39 tool calls in May to 877 by mid-July. Three stolen credentials were subsequently used against a live AWS account, with two cases involving Bedrock model invocation for LLMjacking. The attacks demonstrated automated reconnaissance, credential harvesting, container escape attempts, backdoor account creation, and Kubernetes enumeration, revealing that exposed MCP servers represent a growing attack surface as AI agent infrastructure proliferates.