CloudSEK Finds Gentlemen Ransomware Affiliate’s Exposed Servers and Stolen Data

Oct 5, 2026 · Original article ↗

Summary

CloudSEK reports that Gentlemen affiliate Azazel used stolen CI/CD secrets and other techniques to compromise more than two dozen organizations, steal about 6TB of data, and operate a separate extortion site. Exposed servers revealed the operation.

Key points

An exposed directory and misconfigured storage revealed Azazel’s three-node operation, which held more than 50TB of storage and approximately 6TB of stolen data from over two dozen organizations across six countries.
Azazel used Gentlemen ransomware tooling while operating the separate LEAKNED site and keeping extortion proceeds outside the group’s operation.
Most victims were accessed through credentials stolen from GitLab CI/CD variables and repository history; one GitLab instance provided access to two unrelated organizations.
A prolonged compromise of an AI platform began with an unauthenticated URL-fetching endpoint. Azazel then recovered encrypted configuration secrets and a JWT from Git history, cracked Grafana credentials, and continuously copied object-storage data.
CloudSEK found operational use of a local MCP server’s exec_in_session function to execute attack tasks, as well as scanning infrastructure searching for exposed MCP ports.
Data was staged across attacker-controlled infrastructure before transfer to MEGA; in one incident, the attacker reportedly deleted a production PostgreSQL data directory after exfiltration.
CloudSEK provided victims with technical notifications and published indicators, a Sigma detection rule, and mitigation guidance.

Article Details

Attack Vectors: Azazel harvested tokens, database credentials, API keys and SSH private keys from GitLab CI/CD variables and repository history. One compromised GitLab instance provided access to two unrelated organizations.
At an AI platform, Azazel exploited an AI medical imaging API that fetched user-supplied URLs without validation, providing unauthenticated access to internal services.
Azazel recovered a Jasypt master key to decrypt cluster configuration secrets and retrieved a removed authentication-bypass token from git history.
Azazel used a locally bound MCP server's exec_in_session function to run ransom-note verification checks across six victim hosts. The operation also scanned for exposed MCP server ports.
The reported exploitation arsenal included a PostgreSQL UDF, Redis SSH write, an OverlayFS SUID container-escape exploit and stolen SSH keys.
Data moved through a C2 upload listener and a dedicated staging server before transfer to MEGA. An incremental object-storage mirror was still transferring data during the investigation.
Defensive Notes: Store CI/CD credentials in a dedicated secrets manager; protect and rotate pipeline variables and tokens, and audit repository history for exposed secrets.
Restrict MCP servers to loopback, audit exec_in_session, and monitor MCP initialization requests from unapproved client identities.
Keep encryption keys and kubeconfig files separate from the configuration files they protect, and rotate cluster credentials if those files may have been exfiltrated.
Limit MinIO bucket access to least-privilege service accounts and monitor unexpected mc mirror or bulk-sync activity.
Protect monitoring databases and logs that may contain credentials. Keep backup credentials separate from production systems and test restoration.
Restrict PostgreSQL COPY TO PROGRAM and audit C extension loading. Alert on unusual CI/CD variable reads, service-account token use, and repository README or Issue changes.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`forgitlab[.]com`	Threat-actor-owned hostname associated with the operations staging server.
IPV4	`141[.]95[.]252[.]30`	Beacon check-in address listed in the article's indicators of compromise.
IPV4	`162[.]220[.]163[.]26`	Azazel's forgitlab operations staging server and stolen-data repository.
IPV4	`23[.]236[.]169[.]183`	Azazel's victim-facing C2 server and exposed open directory; port 9999 received stolen data.
IPV4	`66[.]179[.]30[.]155`	Azazel's novostnik server hosting the LEAKNED leak site and long-term archive.
IPV4	`66[.]203[.]124[.]135`	Address identified as the MEGA cloud final exfiltration destination on port 443.