Azazel (Threat actor): news timeline & CVEs

ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.

Socket reported malicious Visual Studio Marketplace and Open VSX themes, including Coca-Cola Christmas and Aurora Borealis Studio Theme, that reuse GlassWorm's Solana dead-drop loader and skip Russian-language systems. Morphisec described a WhatsApp "Statement.exe" lure that delivers VulcanRAT207 using PoolParty process injection, the signed GoFly64.sys BYOVD driver, and Vulkan DLL side-loading. A 28-year-old Russian alleged Qilin member was extradited from Japan to Germany over a September 2024 logistics-company encryption and more than $160,000 in crypto extortion. Forescout found only 6% of IoMT devices among 2.5 million surveyed can support a post-quantum SSH transition.

The Hacker News17:58 UTC · 4h agoMalware in the wild

Ransomware Hacker Uses AI Coding Assistant as Attack Channel Against Enterprise Networks

Ransomware affiliate Azazel used an AI coding assistant's MCP tools to attack more than two dozen organizations.

CloudSEK reported that ransomware affiliate Azazel, working with the Gentlemen ransomware group, used an AI coding assistant as an intrusion channel against more than two dozen organizations in six countries, including logistics, insurance, pharmaceuticals, medical devices, and AI firms. Azazel registered a reverse-shell handler as an MCP tool and used it to run commands, including a script that verified ransom notes on internal hosts. Most access came from GitLab pipeline variables and repository history; one software provider breach reached more than 150 databases and over a dozen clients, and another victim lost more than 120,000 financial records before production data was deleted. A separate imaging-API attack stole more than 6TB, and Azazel ran an independent leak-and-extortion operation rather than sharing proceeds with Gentlemen.

Cyber Security NewsOct 6, 14:09 UTC · 2d agoRansomware in the wild 3 sources

Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks

Gentlemen ransomware affiliate Azazel used Model Context Protocol as live command-and-control across victims in six countries.

CloudSEK reported that Russian-speaking Gentlemen affiliate Azazel used the Model Context Protocol to run commands during live intrusions, calling exec_in_session on an MCP service at 127.0.0.1:35367. He also ran LEAKNED, a leak site allegedly diverting extortion proceeds from the Gentlemen ransomware-as-a-service operation. Investigators found more than two dozen victim directories across six countries, including theft of over 120,000 records from a government-linked financial registry and deletion of its PostgreSQL data directory. Loot was staged on infrastructure exceeding 50TB combined and moved with aws s3 sync, scp, pg_dump, MinIO, and MEGA. CloudSEK called it confirmed MCP command abuse, not a new MCP software vulnerability.

GBHackersupdated Oct 6, 14:09 UTC · 2d agofirst Oct 6, 12:43 UTC · 2d agoRansomware in the wild 3 sources

Azazel

Timeline3 articles

Appears with

ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

Ransomware Hacker Uses AI Coding Assistant as Attack Channel Against Enterprise Networks

Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks