Ransomware affiliate double-crossed The Gentlemen RaaS to steal victim funds

CloudSEK's October 5 report The Gentlemen Files reveals that Russian-speaking hacker Azazel, an affiliate of The Gentlemen RaaS group, ran his own leak site Leakned and kept extortion proceeds from over two dozen victims across six countries. His two servers held terabytes of stolen data, including 6TB from a medical-imaging firm breached via SSRF in an AI API.

• Azazel collected ransoms via his own Leakned site, bypassing The Gentlemen
• SSRF in an AI medical-imaging API yielded 6TB of stolen data
• He used an AI coding assistant over MCP to run commands on a victim's machine
• He kept a 29TB staging server and a 22TB vault instead of renting VPS nodes