Thought Leadership
Cybernews has discovered a server on which an affiliate of the ransomware group The Gentlemen was running an almost fully AI-driven extortion operation.
First observed in July 2025, The Gentlemen is currently among the most active ransomware groups worldwide, claiming around 700 victims according to its own statements—equivalent to approximately 10 percent of all publicly known ransomware cases globally. The infrastructure discovered on the server, a primary Windows VPS in the US as well as several other servers in other countries, was specifically targeted at vulnerable or misconfigured GitLab instances for which the attacker already possessed compromised credentials.
Through a compromised GitLab instance, attackers gain not only insight into internal system structures, but often also direct access to access tokens, SSH keys, and other sensitive data. For the actual remote access, the actor used the tool Penelope, which operates via a so-called reverse shell connection where the already compromised system itself connects back to the attacker’s server, thereby bypassing traditional firewall security measures. Aras Nazarovas, security researcher at Cybernews and discoverer of the publicly accessible server, contextualized the finding as follows:
“Ransomware has effectively turned into a passive source of income.”
Aras Nazarovas, Security Researcher at Cybernews
AI agent takes over virtually the entire attack execution
On the server, the researchers found a total of eight services connected to the Penelope tool, including a dedicated interface based on the Model Context Protocol standard through which an AI agent could interact directly with the reverse shell, as well as 86 AI-generated Python scripts, each already configured with the specific target addresses of real victims. The AI agent was operated using the open-source, freely available Hermes Agent Framework, powered by the Chinese language model DeepSeek-V4-Pro.
According to Nazarovas, most attacks begin simply as basic AI prompts: The attacker hands the agent a GitLab address, username, and password—likely acquired from infostealer logs or access brokers—after which the agent independently adapts the exploitation scripts to the respective target environment. According to the logs found on the server, a single attack on a company cost only the equivalent of $0.40 to $4.00 in pure AI token costs, excluding the underlying infrastructure.
The ransomware affiliate has apparently completely abandoned traditional data encryption, focusing exclusively on pure data theft extortion, in which the AI creates so-called pressure dossier files and automatically calculates the optimal ransom demand based on them.
Bypassing AI safety guardrails via fictional hacking exercise scenario
To bypass the AI model’s intended safety mechanisms, the attacker disguised the real attacks as an Alice in Wonderland-inspired, purely fictional capture-the-flag exercise for security researchers, based on a publicly available GitHub project for training on GitLab CI/CD vulnerabilities. As a result, the AI agent apparently assumed it was merely solving an exercise rather than attacking real companies, developing on this basis a complete penetration testing framework of its own—including configuration analysis, automated searches for embedded credentials, API enumeration, as well as independently written scripts for privilege escalation and lateral movement within the network, each tailored to the actual vulnerabilities found in the respective GitLab instance.
Attacks hit companies virtually indiscriminately across many industries
The approximately 30 affected companies spanned a wide range of industries, including marketing, healthcare, consulting, compliance, real estate, software development, telecommunications, manufacturing, and transport—an indication that the attacks were opportunity-based rather than targeted. Only one of the victims was already listed on The Gentlemen’s actual darknet leak site at the time of discovery. Prior to publication, Cybernews reported the findings to the Lithuanian CERT and Lithuanian police, who subsequently passed the information on to international partner authorities.
Recommended mitigation measures
Nazarovas advises companies to immediately replace compromised credentials and actively monitor sensitive accounts for potential appearances in darknet forums, rather than waiting until their own organization appears in corresponding infostealer logs. Cybernews also recommends active monitoring of GitLab access with automated blocking upon suspicious behavior, such as mass repository cloning, the use of unauthorized tools on CI/CD runners, or attempts at lateral movement within the network. Sensitive credentials should generally not be stored in code repositories—even if marked as private—and GitLab instances should be accessible only from trusted networks or via a VPN allowlist and continuously kept up to date with security patches.
(Editorial Team)
