Caught in 4K: The Gentlemen Files A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent leak site LEAKNED, keeping all extortion proceeds. Attack chains primarily exploited CI/CD secrets from GitLab instances, with one deep compromise involving an AI platform through SSRF, credential decryption, and continuous object storage exfiltration. Azazel operationalized MCP (Model Context Protocol) as a command-and-control channel, marking the first documented criminal use of AI assistant tooling for attack execution. Infrastructure consisted of three nodes totaling over 50TB storage capacity, with approximately 6TB of actively transferring victim data discovered during investigation. Victims spanned logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent sectors. Pulse ID: 6ac3a6d89aeb3e3d383d6d06 Pulse Link: https://otx.alienvault.com/pulse/6ac3a6d89aeb3e3d383d6d06 Pulse Author: AlienVault Created: 2026-10-05 13:32:08 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #RaaS #Credential #OTX #AlienVault