#cicd

The ransomware affiliate ran his commands through an AI assistant's tool protocol, then scanned the internet for more of them

CloudSEK documents a Gentlemen ransomware affiliate who wired Model Context Protocol into his attack chain as an execution channel, reached every victim through stolen CI/CD secrets, and published the proceeds on his own leak site rather than the gang's. The investigation started with an open directory he left unauthenticated.