A Russian-speaking ransomware affiliate known as Azazel has been caught operating one of the most audacious betrayals in the cybercriminal underground. As an affiliate of the notorious Gentlemen ransomware group, Azazel used the gang's tools, negotiation channels, and ransom note templates while also running an independent leak site called LEAKNED. Rather than routing victim data through the Gentlemen program, he published stolen information independently, exposing victims to extortion attempts from both operations.[1]
CloudSEK's threat intelligence team uncovered the scheme after a single exposed server revealed the entire operation. The investigation identified more than two dozen organizations across six countries targeted by Azazel, spanning logistics, insurance, pharmaceuticals, artificial intelligence, medical devices, and government-adjacent infrastructure. The operator maintained dedicated physical servers totaling more than 50TB, including a 22TB long-term vault designed to retain stolen data across multiple campaigns, far exceeding the typical affiliate infrastructure footprint.
Attackers compromised every confirmed victim through stolen CI/CD secrets, showing how development infrastructure security failures cascade into organizational breaches. One compromised GitLab instance provided footholds at two unrelated organizations. A single exposed CI/CD token granted access to more than 150 databases across a Software-as-a-Service platform and its clients, according to the operator's own published claims.
Azazel registered a reverse shell as a callable tool within an AI agent harness using the Model Context Protocol, a technique CloudSEK found no prior public reporting outside this operation. He built scanning infrastructure to identify exposed AI assistant ports across the internet and employed AI assistance to manage his own criminal infrastructure, representing a notable convergence of criminal operations and emerging technology.
Against one artificial intelligence firm, Azazel conducted a prolonged compromise beginning with an unvalidated AI imaging API. The attack progressed through bulk credential decryption, JWT token recovery from git history, offline Grafana password cracking, and a comprehensive Kubernetes environment sweep. The attackers exfiltrated more than 6TB, with transfers continuing during the investigation and growing by hundreds of gigabytes between observations.
In one particularly damaging incident involving a government-linked financial registry, Azazel exfiltrated more than 120,000 records before deleting the victim's live production database entirely. Multiple operational scripts contain fluent Russian prose, and the staging server was codenamed "novostnik," Russian for "newsman," providing clear attribution signals.
CloudSEK coordinated notifications to identify organizations before publication and shared comprehensive technical details with each named victim's security contact.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/ransomware-affiliate-betrays-the-gentemen--9816.html
Comments