Back Gbhackers

Exposed Server Leaks TheGentlemen Ransomware Toolkit, Credentials, and Ngrok Tokens

Gbhackers •Mayura Kathir • March 30, 2026

A fully operational TheGentlemen ransomware toolkit on an exposed server, revealing victim credentials, ngrok tokens, and a complete pre-encryption playbook. This led them to an unauthenticated HTTP server at 176.120.22[.]127:80, hosted by Russian bulletproof provider Proton66 OOO, exposing 126 files across 18 subdirectories and 140 MB of data. Proton66 has previously been tied to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Toolkit Exposed: TheGentlemen Affiliate's Operations Uncovered Researchers found an exposed server on a Russian bulletproof hosting provider containing a complete ransomware toolkit linked to TheGentlemen affiliate. The toolkit includes various utilities for credential dumping, remote access, and defense evasion, along with plaintext ngrok tokens and victim credentials. The investigation revealed 126 files cataloged, including tools for privilege escalation and scripts for disabling security measures. TheGentlemen operates as a Ransomware-as-a-Service (RaaS), allowing affiliates to conduct attacks with shared resources. Analysts have mapped the toolkit components to MITRE ATT&CK techniques, emphasizing the need for defenders to monitor specific behaviors. Recommendations include blocking outbound connections to the identified IP and enforcing application whitelisting. Immediate incident response actions are advised upon detection of the toolkit's use. 3 sources 73

Extracted Entities

Exposed Server Leaks TheGentlemen Ransomware Toolkit, Credentials, and Ngrok Tokens

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)

Tools (1)