An AI agent is hacking and extorting dozens of victims simultaneously with little human oversight, obliterating the traditional costs and efforts associated with cybercrime. Cybernews has gained a rare inside look at a massive ransomware operation run by an affiliate of “The Gentlemen,” one of the world’s most prolific ransomware gangs.

On July 22nd, 2026, the Cybernews research team discovered an exposed server. It contained massive amounts of data: 3.1TB stolen from over 30 companies.

And not only that.

An entire ransomware operation was running on the discovered infrastructure. It hosted malicious payloads, internal exploitation tools, an AI agent harness, and all the dumps covering the entire attack lifecycle, from initial access to ransom demands.

The server belonged to the Gentlemen ransomware affiliate, a Russian-speaking threat actor.

The Gentlemen, first observed in July 2025, is one of the most active ransomware gangs, having claimed around 700 victims globally in just a year of operation and accounting for roughly 10% of all ransomware victims.

The shocking discovery unveils the irreversible changes in cybercrime.

“Ransomware has effectively turned into a passive revenue stream,” said Aras Nazarovas, a security researcher at Cybernews, who discovered the leaking server.

What did we find on the server?

The discovered infrastructure includes a primary Windows VPS (virtual private server) in the US, which led to the discovery of several additional servers in other countries. The storage server’s hostname suggests that it was designed to target vulnerable and misconfigured GitLab instances. The attacker abuses compromised credentials for initial access.

GitLab is a platform, often self-hosted, for storing private code repositories and collaborating on projects. A compromised GitLab instance provides attackers with blueprints of internal company systems, often along with credentials such as access tokens, SSH keys, and other secrets.

The threat actor uses Penelope, a terminal-like tool for interacting with the compromised machines after initial access, which can drop additional payloads, exfiltrate data, and more.

It is a reverse shell connection – compromised systems themselves initiate the connection to the attacker's server, bypassing firewalls.

Eight services related to Penelope were found running on the server, including the following:

• Penelope MCP (Model Context Protocol) interface – a connector for AI agents to interact with the reverse shell.
• A beacon for deploying malicious payloads on compromised hosts.
• Upload web server – a “drop box” for receiving data (HTTP PUT) from victim servers.
• Three active penelope reverse shells.
• Hermes harness.
• Open web directory.

Eighty-six AI-generated Python scripts were found configured with actual victim endpoints. They’re used for various post-exploitation tasks.

The server was also running MEGAcmd – a cloud hosting service’s CLI client – to actively back up data from the server. Timestamps indicate that the leaking server only temporarily stored exfiltrated data from ongoing cases. Ransom notes sent to victims attributed the activity to The Gentlemen.

But the most important thing deployed on the server is the brain behind the operation – an AI agent.

AI does all the work for just $4 in token charges

The malicious activity relies almost entirely on AI automation, with minimal human oversight.

“Most attacks start as AI prompts. The attacker simply provides the AI agent with GitLab URL, username, and password, likely obtained from stealer logs or purchased from initial access brokers,” Nazarovas explains.

“The AI agent adjusts and modifies the exploit scripts based on individual victim environments.”

The exposed VPS was running the Hermes Agent – an open-source, widely-used free AI harness for self-improving and autonomous AI assistants.

Hermes was powered by DeepSeek-V4-Pro, a flagship reasoning model from the Chinese artificial intelligence company, DeepSeek.

“The threat actor asks Hermes to compromise a service, perform reconnaissance, and exfiltration. They simply supply the target, compromised credentials for it, and only query the AI with questions, directing it to perform criminal actions. The AI agent has direct access to attacker-defined skills for recon, exfiltration, reverse shells, as well as files,” Nazarovas explained.

The logs indicate the absurdly low cost of the entire operation – a single attack costs as low as $0.40-$4.00 in tokens per company, not counting the supporting infrastructure costs.

The Hermes agent can simultaneously compromise and extort multiple targets and is used at all stages of the attack, including determining ransom demands.

The ransomware affiliate has completely abandoned traditional encryption. It now focuses exclusively on data-theft-based extortion, using AI to generate “pressure dossiers” and calculate optimal ransom demands based on the data obtained.

A deeper look: How do criminals jailbreak AI?

You can’t simply ask an AI assistant to hack a company and “make no mistakes” – normally, guardrails should prevent AI models from executing malicious requests.

However, the analyzed threat actor bypasses security controls by presenting the task as a cybersecurity “Capture The Flag” (CTF) challenge, themed after Alice in Wonderland.

“We found source files for an open-source CTF challenge deployed by an AI agent, as well as scripts suggesting that it was solved by an AI agent. The CTF challenge was cloned from a public GitHub repository and was originally designed to test security professionals’ skills in exploiting common GitLab CI/CD vulnerabilities and weaknesses,” Nazarovas said.

The AI agent is tricked into believing that it’s solving cybersecurity challenges, including OWASP’s Top 10 most critical cybersecurity risks, rather than compromising actual victims.

The leaking server revealed that the AI agent had developed the entire CI/CD penetration testing framework. The playbook included the following parts:

• Use open-source tools for configuration analysis (SAST).
• Use open-source tools for secret scanning.
• Use open-source tools for API enumeration.
• Use open-source tools for secret extraction.
• Use Penelope shells for interacting with target runners and pivot hosts.
• Use an open-source post-exploitation C2.

The 86 retrieved Python scripts contained numerous post-compromise automation scripts for establishing persistence, creating database dumps, archiving, sending data to threat actors' servers, and performing cleanup and anti-forensics tasks.

“Most of these scripts were integrated with a locally hosted Penelope MCP orchestration service and likely were just helpers for an MCP-based agent, adjusting payloads on the fly,” Nazarovas said.

These types of cyberattacks completely evade signature-based detection. An AI agent writes its own post-exploit scripts for container escape, psql command execution, lateral movement, and privilege escalation, depending on what’s found in the GitLab instance and detected vulnerabilities.

The data of all targeted victim organizations was organized in separate directories (folders), containing numerous files generated by the AI agent: Hermes agent logs, Company information, exploitation probability assessments, vulnerable asset lists, data resale value assessments, operation summaries, and exploitation vectors.

The threat actor pursues diverse monetization strategies:

• Direct extortion, demanding ransom from the original victim.
• Offering data to business competitors – source code and private data are offered separately.
• Auctioning data on the dark web.
• Conducting phishing and SMS fraud campaigns themselves.

Because the server was limited to attacks against GitLab instances, the same threat actor may operate other workflows and infrastructure tailored for other initial access vectors.

The leak indicates that ransomware affiliates have already implemented AI automation, turning cybercrime into a passive revenue stream.

How did this affiliate get exposed?

“Even relatively sophisticated operations are not immune to simple misconfigurations that may lead to catastrophic outcomes, especially when heavily relying on AI to set up their infrastructure and operations,” Nazarovas said.

Opportunistic attacks can hit any company

AI automation enabled the threat actor to compromise and extort around 30 companies simultaneously. The companies spanned the marketing, healthcare, consulting, compliance, real estate, software development, telecommunications, manufacturing, and transportation industries, suggesting that attacks are opportunistic.

Only one of the victims was listed on the Gentlemen’s data leak site on the dark web shortly after the initial discovery of the leak.

The findings were responsibly reported to CERT and the police in Lithuania prior to publication, and the authorities shared the information with international partners.

How to protect yourself from similar threats?

This criminal operation highlights the importance of rotating compromised credentials and monitoring sensitive accounts for exposure on darknet forums.

“Don’t wait for the company to appear in the infostealer logs. The most important thing is to prevent initial access as quickly as possible,” Nazarovas suggests.

Cybernews researchers recommend that companies actively monitor GitLab access and implement automated blocking for suspicious behavior, such as bulk repository cloning, deploying reverse shells and unauthorized tools on CI/CD runners, executing PostgreSQL user-defined functions, exploiting known vulnerabilities, or attempting lateral movement and container escapes.

Avoid storing sensitive secrets in source code repositories, even if they’re private. Continuously audit repositories and CI/CD implementations for insecure configurations and other security issues.

“Restrict public access to sensitive resources – ensure that GitLab instances and other sensitive resources are only accessible from a trusted network, or VPN allowlist, to make it more difficult for malicious actors to access them,” Nazarovas suggests.

The entire network should also be monitored for suspicious activity, including SSH connections, HTTP PUT requests that send internal data outside trusted networks, and reverse shells such as Netcat or Penelope.

Keep GitLab instances, ticket tracking, and any other software up to date and immune to known exploits.

Some of the known GitLab vulnerabilities, leveraged in the analyzed campaign, include the following:

• CVE-2021-22205 (remote code execution).
• CVE-2023-7028 (account takeover).
• CVE-2023-2825 (path traversal).
• CVE-2021-22214 (server-side request forgery).