Caught in 4K: The Gentlemen Files

CloudSEK investigators uncovered a Russian-speaking affiliate calling themselves Azazel who used Gentlemen RaaS tooling and independent infrastructure to compromise over two dozen organisations, exfiltrate terabytes of sensitive data (6TB+ in one AI-target engagement and >29TB of staged storage across nodes), run a separate leak site (LEAKNED) to publish victims and collect extortion payments, and operationally abused MCP exec_in_session as a C2 channel. The operation combined large-scale CI/CD secret harvesting, targeted SSRF and credential recovery against an AI company, dedicated bare-metal staging and long-term vault servers, and multi-hop exfiltration to MEGA, with active transfers observed during the investigation.