What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CloudSEK researchers say an affiliate of The Gentlemen ransomware operation used its tools to breach organizations, then diverted victims to a separate leak site and negotiated for ransom independently—allegedly keeping the proceeds instead of sharing them with the group. Cybernews reported the findings on October 7, 2026; the account is a researcher-reported allegation, not a court finding.
What “double-crossing” allegedly means
The reported betrayal was about control of the victims and the money. The affiliate, identified as “Azazel,” allegedly used The Gentlemen’s infrastructure and tooling to carry out intrusions, but then handled extortion outside the group’s normal arrangement.
- Azazel allegedly operated a separate leak site called “LEAKNED.”
- The affiliate reportedly contacted victims and negotiated directly, rather than sharing those negotiations with The Gentlemen.
- Cybernews, citing CloudSEK, says the affiliate collected the ransom proceeds independently.
These details come from CloudSEK’s findings as relayed by Cybernews. They describe an alleged affiliate scheme; they do not establish a court-tested account of who received any particular payment.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What CloudSEK reportedly found
Cybernews says CloudSEK discovered an exposed open directory and a misconfigured storage server. The researchers reportedly linked the exposed infrastructure to Azazel and the separate operation. CloudSEK’s October 5, 2026 update listing calls the investigation “Caught in 4K: The Gentlemen Files” and summarizes victims in six countries, exposed infrastructure, and a live AI-driven chain.
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
The reported storage figures refer to different scopes and should not be added together as if they measured the same thing:
- More than two dozen organizations across six countries: CloudSEK’s reported victim scope, as described by Cybernews.
- Roughly 6TB: data attributed to victims in CloudSEK’s account—not the total raw storage volume.
- More than 29TB: raw storage across two servers, according to Cybernews’s account of CloudSEK’s findings.
- 50TB: the figure used in Cybernews’s headline and description for exposed infrastructure. It is not interchangeable with either the raw-storage figure or the victim-data estimate.
What the AI and MCP detail does—and does not—show
CloudSEK reportedly described an attack chain involving an AI assistant, Model Context Protocol (MCP), and reverse PowerShell. It said the campaign included one confirmed operational use of MCP exec_in_session as a command-and-control channel. CloudSEK’s novelty statement, quoted by Cybernews, was: “CloudSEK has not identified prior public reporting of a threat actor operationally using MCP exec_in_session as a C2 channel in a live criminal campaign. This investigation documents one confirmed instance.”
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
That wording is limited to CloudSEK’s assessment of prior public reporting and one instance it says it confirmed. It does not show that MCP is generally unsafe, or that an AI system autonomously chose targets or negotiated ransoms.
How this fits The Gentlemen’s broader operation
Microsoft tracks The Gentlemen’s operators as Storm-2697 and describes the group as a ransomware-as-a-service (RaaS) platform: operators provide a service and affiliates carry out attacks. Microsoft says the group emerged around mid-2025 and began offering the service to affiliates in September 2025. It describes the group’s approach as double extortion—stealing sensitive data as well as encrypting it—and reports impacts across education, transportation, healthcare, and finance in multiple regions. Microsoft’s technical analysis also includes defender guidance, detections, hunting queries, and indicators of compromise.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Check Point’s Q2 2026 report counted 269 victims posted by The Gentlemen in its tracked leak-site dataset, a 62% increase from the prior quarter. That made the group second in Check Point’s ranking; in June, it recorded 116 Gentlemen postings versus 72 for Qilin. These are counts of observed leak-site postings in that report, not a complete census of attacks or proof of the separate allegations about Azazel. Check Point also describes a wider operation with roughly nine core operators and eight affiliate identities in leaked chat records, and reports a 90/10 affiliate/operator split. Those broader figures provide context, not evidence about how Azazel handled any specific payment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations can take from the report
The alleged diversion does not change the practical priority after a suspected ransomware intrusion: contain the incident, determine what was accessed or taken, and bring in qualified incident-response support. Microsoft’s guidance is aimed at defenders and includes technical material for detection and investigation. Threat intelligence can help organizations understand activity attributed to groups and affiliates, while incident response focuses on investigating and containing a suspected breach; the sources cited here do not compare specific providers.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
