Gentlemen (Malware): news timeline & CVEs

ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.

Socket reported malicious Visual Studio Marketplace and Open VSX themes, including Coca-Cola Christmas and Aurora Borealis Studio Theme, that reuse GlassWorm's Solana dead-drop loader and skip Russian-language systems. Morphisec described a WhatsApp "Statement.exe" lure that delivers VulcanRAT207 using PoolParty process injection, the signed GoFly64.sys BYOVD driver, and Vulkan DLL side-loading. A 28-year-old Russian alleged Qilin member was extradited from Japan to Germany over a September 2024 logistics-company encryption and more than $160,000 in crypto extortion. Forescout found only 6% of IoMT devices among 2.5 million surveyed can support a post-quantum SSH transition.

The Hacker News17:58 UTC · 4h agoMalware in the wild

Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks

Gentlemen ransomware affiliate Azazel used Model Context Protocol as live command-and-control across victims in six countries.

CloudSEK reported that Russian-speaking Gentlemen affiliate Azazel used the Model Context Protocol to run commands during live intrusions, calling exec_in_session on an MCP service at 127.0.0.1:35367. He also ran LEAKNED, a leak site allegedly diverting extortion proceeds from the Gentlemen ransomware-as-a-service operation. Investigators found more than two dozen victim directories across six countries, including theft of over 120,000 records from a government-linked financial registry and deletion of its PostgreSQL data directory. Loot was staged on infrastructure exceeding 50TB combined and moved with aws s3 sync, scp, pg_dump, MinIO, and MEGA. CloudSEK called it confirmed MCP command abuse, not a new MCP software vulnerability.

GBHackersupdated Oct 6, 14:09 UTC · 2d agofirst Oct 6, 12:43 UTC · 2d agoRansomware in the wild 3 sources1

Gentlemen

Timeline2 articles

Appears with

ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks