An AI agent compromised roughly 30 companies, exfiltrated 3.1TB of data and drafted the ransom demands. Token costs ran between 40 cents and four dollars per victim.
Researchers at Cybernews found the exposed server on 22 July 2026. They published their analysis in Exposed ransomware server reveals automated $4 cyberattacks on 2 September. The server belonged to an affiliate of The Gentlemen, a Russian-speaking ransomware group.
The Gentlemen was first observed in July 2025 and has claimed around 700 victims globally in a year. The report puts that at roughly 10 per cent of all ransomware victims.
"Ransomware has effectively turned into a passive revenue stream," said Aras Nazarovas, the Cybernews security researcher who found the leaking server.
The infrastructure hosted malicious payloads, exploitation tools, an AI agent harness and dumps covering the full attack lifecycle from initial access through to ransom demands.
The storage server's hostname indicated it was built to target vulnerable and misconfigured GitLab instances. Initial access came from compromised credentials, likely bought from access brokers or taken from infostealer logs.
That target choice is deliberate. A compromised GitLab instance yields both source code and the credentials embedded around it, including access tokens and SSH keys.
Post-access activity ran through Penelope, a terminal-like tool for interacting with compromised machines. It uses a reverse shell, so the victim system initiates the connection outbound and bypasses inbound firewall rules.
Eight Penelope-related services were found on the server. They included an MCP interface letting AI agents drive the reverse shell, a payload beacon and an upload server for exfiltrated data.
Eighty-six AI-generated Python scripts were recovered, configured with real victim endpoints. They handled persistence, database dumps, archiving, transfer and anti-forensics.
The agent did the work
The exposed server was running the Hermes Agent, an open-source harness for autonomous AI assistants, powered by DeepSeek-V4-Pro.
"Most attacks start as AI prompts. The attacker simply provides the AI agent with GitLab URL, username, and password," Nazarovas said. "The AI agent adjusts and modifies the exploit scripts based on individual victim environments."
The agent was used at every stage, including calculating ransom demands. Victim data was organised into per-company directories holding agent logs, company information, exploitation probability assessments, vulnerable asset lists and data resale value assessments.
The agent writes its own scripts for container escape, lateral movement and privilege escalation based on what it finds. The resulting activity carries no reusable signature.
The operator sidestepped model safety controls by presenting the work as a capture the flag exercise, themed around Alice in Wonderland.
Cybernews found source files for an open-source CTF challenge, cloned from a public GitHub repository, originally written to test skills in exploiting GitLab CI/CD weaknesses. The agent was led to believe it was solving security challenges rather than compromising live victims.
It then built out a full CI/CD penetration testing playbook, covering configuration analysis, secret scanning, API enumeration, secret extraction and post-exploitation command and control.
The affiliate has dropped file encryption and works purely on data theft extortion. The agent generates what Cybernews describes as pressure dossiers and calculates optimal ransom demands from the material obtained.
Monetisation runs on four tracks. They are direct extortion of the victim and selling data to competitors, with source code offered separately. The others are dark web auctions and running phishing and SMS fraud campaigns.
The victims spanned marketing, healthcare, consulting, compliance, real estate, software development, telecommunications, manufacturing and transportation. Cybernews reads the spread as evidence the attacks were opportunistic rather than targeted.
Only one victim had appeared on the group's leak site shortly after the discovery. The findings were reported to CERT and police in Lithuania before publication, and passed to international partners.
Known vulnerabilities, familiar advice
The GitLab vulnerabilities used in the campaign are all long-patched. They are CVE-2021-22205 for remote code execution, CVE-2023-7028 for account takeover, CVE-2023-2825 for path traversal and CVE-2021-22214 for server-side request forgery.
"Don't wait for the company to appear in the infostealer logs. The most important thing is to prevent initial access as quickly as possible," Nazarovas said.
Cybernews recommends monitoring GitLab access with automated blocking for bulk repository cloning, reverse shell deployment on CI/CD runners and attempted lateral movement. It also advises restricting GitLab instances to trusted networks or a VPN allowlist.
Secrets should not be stored in source repositories even where those repositories are private, and CI/CD configurations should be audited continuously.
The affiliate was exposed by its own misconfiguration. "Even relatively sophisticated operations are not immune to simple misconfigurations that may lead to catastrophic outcomes, especially when heavily relying on AI to set up their infrastructure and operations," Nazarovas said.