Ransomware Affiliate Azazel Betrays Gang, Exfiltrates Data from Multiple Victims

• •Azazel, a ransomware affiliate, betrayed The Gentlemen RaaS by creating his own leak site.
• •He exploited GitLab CI/CD secrets and SSRF vulnerabilities to exfiltrate over 6TB of data.
• •CloudSEK's report indicates Azazel's operations reflect advanced cybercriminal tactics, including AI tooling.

A Russian-speaking ransomware affiliate named Azazel has betrayed his Ransomware as a Service (RaaS) operator, The Gentlemen, by establishing his own leak site called Leakned. Using the group's tools, he extorted over two dozen organizations across six countries, targeting sectors such as logistics, medical services, and government. Azazel's attack methods included exploiting exposed GitLab CI/CD secrets and a server-side request forgery (SSRF) vulnerability in an AI medical-imaging API. He managed to exfiltrate more than 6TB of data and published victim data on his independent site, collecting extortion proceeds without routing them through The Gentlemen. His operations included sophisticated techniques like using AI tools to manage his infrastructure and running attacks through a reverse shell. CloudSEK, which reported these findings, believes Azazel is linked to Russia due to the language used in his operational scripts. The report highlights a significant breach of trust within the cybercriminal community, as this incident follows another recent betrayal involving the ShinyHunters group.