Gentlemen RaaS affiliate ran his own leak site to pocket the ransoms, CloudSEK says
Azazel, a Russian-speaking affiliate of The Gentlemen RaaS crew, ran his own leak site to extort over two dozen victims and kept the proceeds, CloudSEK found. His way in was secrets left in old GitLab commits.
The Watch · Security desk
What happened
- CloudSEK found two exposed servers holding several terabytes stolen from logistics, insurance, pharmaceutical, AI, medical device and government victims across six countries.
- Inside that network he connected an AI coding assistant to a reverse-shell handler over MCP, using the assistant to issue commands to a compromised machine.
- He kept stolen data on a 29TB staging server linked to a 22TB vault, instead of the temporary cloud storage or rented VPS nodes most Gentlemen affiliates use.
Why it matters
- Who's exposed exposure Paying The Gentlemen operator settles with the operator. Azazel collected and leaked outside the program, so a single ransom does not retire the stolen data.
- Who has to decide decision The GitLab entry rewards rotating secrets, not deleting them. Pulling a CI/CD token from the current repo leaves it live in commit history, which is where Azazel found it.
- What it sets up precedent An affiliate running his own leak site behind the operator breaks the premise of ransomware negotiation and points to more fragmented extortion, where no single payee controls the data.
Next story · Build · yesterday
Anthropic and OpenAI fund separate firms to station engineers inside customersConfirmed2 publishers
Beyond extorting victims, Azazel cut out the operator whose malware he used, publishing stolen data and collecting the money on Leakned, a leak site he built and ran himself [7][1]. "Azazel was not running a standard affiliate playbook," CloudSEK said in The Gentlemen Files, published October 5 [8][5].
The first chain was credential theft. Azazel harvested secrets from exposed GitLab infrastructure: CI/CD tokens, database credentials, API keys and SSH private keys, which opened cloud systems and databases [9]. CloudSEK assessed that developers had deleted those secrets from current repositories but left them in earlier commits, where Azazel went looking [10].
The second chain was hands-on. Against a medical-imaging company, Azazel exploited a server-side request forgery flaw in an unauthenticated AI medical-imaging API, mapped internal services, then hunted credentials to internal data stores [3]. CloudSEK described it as a "sustained, multi-stage compromise that ran for weeks" [4]. During it he wired an AI coding assistant to a reverse-shell handler over MCP and used the assistant to push commands to a machine inside the victim network [11]. "The Chain B engagement ... reflects a skill level well above standard affiliate tradecraft," the report said [6].
CloudSEK flagged the AI tooling as more than a single trick: "The MCP tooling adds a further dimension: operational use against one victim cluster, global scanning infrastructure for exposed AI assistant ports, and confirmed use of AI tooling for the operator's own infrastructure management" [12]. He also stored data differently from his peers. Azazel kept a 29TB staging server connected to a separate 22TB vault, 51TB in all, instead of the temporary cloud storage or rented VPS nodes most Gentlemen affiliates use [13][14].
What to watch
- Whether law enforcement or CloudSEK moves on Azazel's two exposed servers before they go dark.
- Whether other RaaS affiliates copy the MCP-driven AI assistant tradecraft against live victims.
- Whether The Gentlemen operator retaliates against affiliates found running side leak sites.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A Russian-speaking cybercriminal, an affiliate of The Gentlemen RaaS tracked as Azazel, betrayed his ransomware-as-a-service partners to make off with funds extorted from over two dozen global victims, CloudSEK said.
- [2]
CloudSEK found two exposed servers managed by Azazel containing several terabytes of data stolen from logistics, insurance, pharmaceutical, AI, medical device and government victims across six countries.
- [3]
In a second case Azazel targeted a medical-imaging company by exploiting a server-side request forgery (SSRF) vulnerability in an unauthenticated AI medical-imaging API, discovered internal services, searched for credentials to internal data stores over a weeks-long compromise, and ultimately compromised 6TB of data.
- [4]
sustained, multi-stage compromise that ran for weeks
- [5]
CloudSEK detailed the case in a report, The Gentlemen Files, published on October 5.
- [6]
The Chain B engagement ... reflects a skill level well above standard affiliate tradecraft
- [7]
Azazel built and operated his own independent leak site under the brand Leakned, publishing victim data and collecting extortion proceeds without routing them through the Gentlemen program.
- [8]
Azazel was not running a standard affiliate playbook
- [9]
In the first attack chain Azazel harvested secrets from exposed GitLab infrastructure including CI/CD tokens, database credentials, API keys and SSH private keys, which provided access to cloud systems and databases.
- [10]
CloudSEK assessed it was likely the secrets had been deleted by developers from the current version of Git repositories but remained in earlier commits, which Azazel found.
- [11]
Azazel used an AI coding assistant in the attack to send commands to a compromised machine on the victim's network, connecting the AI tool to a reverse-shell handler via MCP.
- [12]
The MCP tooling adds a further dimension: operational use against one victim cluster, global scanning infrastructure for exposed AI assistant ports, and confirmed use of AI tooling for the operator's own infrastructure management
- [13]
Azazel maintained a 29TB dedicated staging server connected to a separate 22TB long-term vault, rather than the temporary cloud storage or rented VPS nodes used by most Gentlemen affiliates.
- [14]
Azazel's staging server and long-term vault held 51TB of storage combined.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comRansomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
1 article · October 6, 2026
- itpro.comNo honor amongst thieves, as hacker betrays his own gang
1 article · October 6, 2026
Topics and entities
Topics
- AI-Assisted Cyberattacks
- Secrets in version control
- Ransomware-as-a-Service