MCP Ransomware: How ‘Azazel’ Weaponised an AI Coding Assistant as a Live C2 Channel to Breach 20+ Enterprises

On 5 October 2026, CloudSEK’s threat-research team published Caught in 4K: The Gentlemen Files — a detailed investigation that documents something cybersecurity professionals have feared for years but never seen in the wild: a ransomware affiliate who weaponised an AI coding assistant as a live command-and-control (C2) channel. The technique exploits the Model Context Protocol (MCP), the open standard that connects AI assistants to external tools, and it changes the threat model for every enterprise that lets developers run AI-assisted workflows.

Background: Who Are The Gentlemen?

The Gentlemen ransomware-as-a-service operation emerged in mid-2025 and shifted to an affiliate model in September 2025. Microsoft Threat Intelligence tracks the operators as Storm-2697. Their encryptor is a Go binary obfuscated with the Garble tool, targeting Windows environments, and uses double extortion: data is exfiltrated before encryption, and victims face the dual threat of operational disruption and public exposure on a dedicated leak site.

The group’s C2 backbone relies on the SystemBC botnet, which Check Point Research estimates at more than 1,570 infected nodes globally, with heavy targeting of enterprise networks across North America, Europe, and the Asia-Pacific region. Initial access is typically obtained through internet-facing edge devices, SSL-VPN appliances, remote management interfaces, and credentials purchased from initial-access brokers (IABs).

By early October 2026, The Gentlemen had publicly claimed approximately 700 victims — a number that almost certainly underrepresents actual compromise. In a darkly ironic turn, the group itself suffered a significant breach in May 2026 when an anonymous entity exfiltrated approximately 16 GB of internal communications and tooling from their backend — offering researchers an unusually clear window into their operations.

The Azazel Technique: Turning MCP into a Ransomware C2

What sets the Azazel campaign apart is not the encryptor or the double-extortion playbook — both are standard The Gentlemen tradecraft. What is genuinely novel is how Azazel maintained persistent command-and-control inside enterprise networks without triggering conventional detection.

The attack chain breaks down as follows:

1. Initial access via stolen GitLab CI/CD credentials. Azazel harvested secrets from misconfigured or compromised GitLab instances — pipeline tokens, runner credentials, and repository secrets. These provided access to build environments and, through them, to developer workstations and staging systems.
2. MCP tool registration. The Model Context Protocol is an open standard, championed by Anthropic and rapidly adopted across the industry, that lets AI coding assistants connect to external tools — databases, shells, APIs. Azazel registered a reverse shell handler as a legitimate-looking MCP tool on compromised developer machines. The specific capability exploited was exec_in_session, which allows MCP tools to execute commands in the active session context.
3. AI assistant as unwitting C2 relay. Every time a developer invoked the AI coding assistant for routine tasks — code completion, refactoring, test generation — the assistant silently forwarded attacker-controlled commands via the MCP channel. The C2 traffic was indistinguishable from normal AI tooling activity and typically traversed ports 443 or 8443 with valid-looking headers.
4. Lateral movement and exfiltration. With persistent remote execution, Azazel mapped internal networks, escalated privileges, and staged data on dedicated exfiltration servers. One medical imaging company alone had 6 TB of data transferred out before detection.

CloudSEK’s report explicitly notes: “We have not identified prior public reporting of a threat actor operationally using MCP exec_in_session as a C2 channel in a live criminal campaign.” That statement alone should put every CISO on notice.

Attack Scale and Victim Profile

The Azazel sub-campaign adds an unusual wrinkle: the affiliate withheld ransom payments from The Gentlemen operators, set up an independent leak site, and ran parallel extortion against at least some victims. This “double-cross” dynamic is rare but not unprecedented in the RaaS ecosystem, and it means victims may face extortion from multiple parties even after engaging with the primary operator.

Why Indian Enterprises Are Especially Exposed

India is now consistently ranked among the top five most targeted nations for ransomware. According to the Microsoft Digital Defense Report 2026, autonomous AI ransomware campaigns are already bypassing traditional detection — and the Azazel technique accelerates that trajectory.

Several factors make Indian organisations particularly vulnerable to MCP-based attacks:

• Rapid AI coding assistant adoption. GitHub Copilot, Cursor, and a growing set of MCP-enabled tools are now in daily use across Indian IT services, banking, and pharma sectors. Many deployments have no formal MCP governance.
• Sprawling GitLab and CI/CD footprints. India’s large IT services industry runs extensive GitLab infrastructure, often with long-lived runner tokens and inadequately rotated pipeline secrets — the exact credentials Azazel targeted.
• CERT-In 6-hour reporting obligation. Under the April 2022 CERT-In directive, Indian organisations must report incidents within six hours. An MCP-based breach that blends into developer-tool traffic can go undetected far longer, exposing leadership to regulatory penalties on top of operational damage.
• Flat developer networks. In many organisations, the development network has broad access to production systems, meaning an AI assistant compromise can quickly traverse into core infrastructure — a failure of zero-trust segmentation principles.

What You Should Do: Sanjay Seth’s Defensive Playbook

Defending against MCP-based C2 requires a layered response that goes beyond patching. Here is an actionable seven-point framework:

1. Audit every MCP tool registration immediately. Query each AI coding assistant deployment for all registered tools. Any tool registering exec_in_session, shell access, or external HTTP callbacks without explicit approval should be removed and investigated.
2. Rotate all GitLab CI/CD secrets and runner tokens. Assume any long-lived token over 90 days is compromised. Move to short-lived, scoped secrets using GitLab’s built-in CI/CD variables with expiry, or integrate with a secrets manager such as HashiCorp Vault or Fortinet’s FortiPAM.
3. Enforce zero-trust micro-segmentation on developer workstations. Dev machines should have no direct path to production subnets. A FortiGate policy that forces developer traffic through an inspection zone — even for internal east-west flows — would have contained Azazel’s lateral movement. Reference architecture: HA SD-WAN with identity-aware routing.
4. Instrument MCP traffic in your SIEM and EDR. Tag AI assistant processes (e.g., cursor, copilot, claude) and alert on any child process spawning or outbound connections to non-whitelisted endpoints. The key signal: a coding assistant making network calls to non-AI-vendor IP ranges.
5. Enforce AI tooling governance policies. Define an approved list of AI coding assistants and MCP tool sources. Treat unapproved MCP tool registrations the same as unapproved software installations — a policy violation requiring immediate remediation.
6. Expand SOC detection rules for double-extortion staging. The 50 TB infrastructure Azazel built required sustained outbound data transfer. Baseline normal exfiltration volumes per host and alert aggressively on anomalous upload bursts — even to known cloud providers.
7. Test your incident response for the 6-hour CERT-In window. Run a tabletop exercise specifically for AI-assisted breach scenarios. Most IR playbooks pre-date MCP; they will not trigger the right containment steps.

Frequently Asked Questions

What is MCP and why is it a security concern?

MCP (Model Context Protocol) is an open standard that allows AI coding assistants to connect to external tools — databases, shells, file systems, and APIs — so they can take actions, not just generate text. The security risk is that any process registered as an MCP tool runs with the same OS permissions as the developer’s session. An attacker who can register a malicious MCP tool gains remote code execution that looks, to network monitoring, like routine developer-AI activity.

Do I need to stop using AI coding assistants?

No — the risk is in uncontrolled MCP tool registrations, not AI assistants per se. Organisations that audit registered tools, enforce allowlists, and sandbox developer workstations from production networks can use AI coding tools safely. The threat is governance failure, not the technology itself.

How does this relate to the wider Gentlemen ransomware threat?

The Gentlemen group (Storm-2697) is an established, multi-hundred-victim operation. Azazel’s MCP technique is one affiliate’s innovation, but given that RaaS groups share tooling rapidly across their affiliate networks, this C2 method is likely to be adopted by other actors within weeks or months of the CloudSEK disclosure.

What should Indian IT leaders prioritise right now?

Three immediate actions: (1) inventory every AI coding assistant and its MCP tools across the organisation; (2) rotate all GitLab runner tokens and CI/CD pipeline secrets; (3) verify that your zero-trust segmentation actually prevents lateral movement from developer machines — many zero-trust deployments have implicit trust on internal subnets that they shouldn’t.