Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds

CloudSEK’s report details how a Russian-speaking affiliate dubbed "Azazel" betrayed the Gentlemen RaaS network by running an independent leak site (Leakned), stealing extortion proceeds and several terabytes of data from logistics, insurance, pharmaceutical, AI, medical device and government victims across six countries; attacks combined GitLab secret harvesting and an SSRF against an unauthenticated AI medical-imaging API, used an AI coding assistant and advanced tooling (kubeconfig harvesting, MinIO sync, Grafana cracking) and maintained large dedicated staging and vault servers.