Bitdefender Threat Debrief Nov 2026: AI-assisted ransomware actors N0n and Azazel (MCP reverse-shell C2), BYOD, Booba Team

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5634 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Azazel Linux Post-Exploitation: Redis/PostgreSQL Abuse, OverlayFS Privesc and Container Escape

Detects Linux post-exploitation behaviours attributed to Azazel by CloudSEK: Redis CONFIG SET dir/dbfilename used to plant SSH keys, PostgreSQL COPY TO PROGRAM command execution, OverlayFS user-namespace privilege escalation, SUID/capability planting in world-writable paths, and container escape to the host (nsenter into PID 1 or privileged container with host root mounted).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1068, T1611, T1021.004
• Data sources: sysmon_for_linux (index=linux sourcetype=sysmon:linux), DeviceProcessEvents (Defender for Endpoint on Linux), linux process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1
``` Azazel TL-2026-5634 Linux post-exploitation: Redis, PostgreSQL, OverlayFS, container escape ```
| eval cmd=lower(CommandLine)
| eval technique=case(
    match(cmd,"redis-cli") AND match(cmd,"config\\s+set\\s+(dir|dbfilename)"), "Redis CONFIG SET dir/dbfilename SSH key planting",
    match(cmd,"psql|pg_ctl") AND match(cmd,"copy\\s.{1,200}\\sto\\s+program"), "PostgreSQL COPY TO PROGRAM command execution",
    match(cmd,"unshare") AND match(cmd,"overlay"), "OverlayFS user-namespace privilege escalation",
    match(cmd,"nsenter\\s.*(-t|--target)\\s+1\\s") OR (match(cmd,"--privileged") AND match(cmd,"-v\\s+/:/")), "Container escape to host",
    match(cmd,"(chmod|setcap)") AND match(cmd,"(u\\+s|4755|6755|cap_setuid)") AND match(cmd,"(/tmp/|/dev/shm/|/var/tmp/)"), "SUID or capability planted in world-writable path")
| where isnotnull(technique)
| stats count AS events values(CommandLine) AS commands values(ParentImage) AS parents min(_time) AS first_seen max(_time) AS last_seen by host User technique
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Cmd = tolower(ProcessCommandLine)
| extend Technique = case(
    Cmd has "redis-cli" and Cmd matches regex @"config\s+set\s+(dir|dbfilename)", "Redis CONFIG SET dir/dbfilename SSH key planting",
    Cmd has_any ("psql", "pg_ctl") and Cmd matches regex @"copy\s.{1,200}\sto\s+program", "PostgreSQL COPY TO PROGRAM command execution",
    Cmd has "unshare" and Cmd has "overlay", "OverlayFS user-namespace privilege escalation",
    Cmd matches regex @"nsenter\s.*(-t|--target)\s+1\s" or (Cmd has "--privileged" and Cmd matches regex @"-v\s+/:/"), "Container escape to host",
    Cmd has_any ("chmod", "setcap") and Cmd has_any ("u+s", "4755", "6755", "cap_setuid") and Cmd has_any ("/tmp/", "/dev/shm/", "/var/tmp/"), "SUID or capability planted in world-writable path",
    "")
| where Technique != ""
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Technique

Sigma

title: Linux Redis, PostgreSQL and Container-Escape Abuse (Azazel TL-2026-5634)
id: 9a4c7e21-3d58-4b96-8f10-6e2b1c5d7a03
status: experimental
description: Detects Redis CONFIG SET dir/dbfilename, PostgreSQL COPY TO PROGRAM, OverlayFS user-namespace privilege escalation, container escape via nsenter or privileged containers, and SUID/capability planting in world-writable paths, as reported for the Azazel Gentlemen RaaS affiliate.
references:
    - https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.execution
    - attack.t1059.004
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1611
    - attack.lateral_movement
    - attack.t1021.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_redis:
        Image|endswith: '/redis-cli'
        CommandLine|contains:
            - 'config set dir'
            - 'config set dbfilename'
    selection_pg:
        Image|endswith: '/psql'
        CommandLine|contains|all:
            - ' copy '
            - ' to program'
    selection_overlay:
        CommandLine|contains|all:
            - 'unshare'
            - 'overlay'
    selection_nsenter:
        CommandLine|contains:
            - 'nsenter --target 1 '
            - 'nsenter -t 1 '
    selection_privileged:
        CommandLine|contains|all:
            - '--privileged'
            - ' -v /:/'
    suid_bits:
        Image|endswith:
            - '/chmod'
            - '/setcap'
        CommandLine|contains:
            - 'u+s'
            - ' 4755 '
            - ' 6755 '
            - 'cap_setuid'
    suid_path:
        CommandLine|contains:
            - '/tmp/'
            - '/dev/shm/'
            - '/var/tmp/'
    condition: 1 of selection_* or (suid_bits and suid_path)
falsepositives:
    - Database administrators using psql COPY TO PROGRAM or redis-cli CONFIG SET on maintenance windows
    - Container platform and debugging tooling that uses nsenter or privileged containers
level: high

Known false positives:

• DBAs running redis-cli CONFIG SET or psql COPY TO PROGRAM during maintenance
• Container tooling and troubleshooting using nsenter or privileged containers

Tuning notes: Scope to database, Kubernetes node and CI runner hosts first; allowlist known DBA accounts and orchestration parent processes (kubelet, containerd-shim); alert on Redis CONFIG SET dir pointing at .ssh paths with higher priority. Redis commands sent over raw sockets rather than redis-cli are not covered; add Redis server command logging if available.

• 🔒 Exposed AWS Access Key Abuse: S3 Enumeration and Bulk Reads or Known N0n/Azazel Source IPs · unlock with TL Creds
• 🔒 CI/CD Secret Harvesting Tooling: nord-stream, glato, gitlab-watchman, gitleaks, Jasypt Decryption · unlock with TL Creds
• 🔒 Azazel Bulk Exfiltration: mc mirror, aws s3 sync, MEGA Upload, Port 9999 POST and N0n/Azazel Infrastructure · unlock with TL Creds
• 🔒 RDP Logon From Public IP Address (Exposed RDP Initial Access, n0n) · unlock with TL Creds
• 🔒 Hidden or Service-Disguised Local Admin Account Creation (N0n Persistence) · unlock with TL Creds
• 🔒 Azazel Impact: Ransom Note Drop, PostgreSQL Data Directory Deletion and Backup Removal · unlock with TL Creds
• 🔒 n0n FortiGate SSL-VPN Credential Stuffing (GET /remote/login) - TL-2026-5634 · unlock with TL Creds
• 🔒 Azazel MCP Reverse-Shell C2: Penelope exec_in_session and AI-Agent-to-Shell Bridge · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5634.

Sample indicators (3 of 21)

• IP address: 23.236.169[.]183
• Domain: forgitlab[.]com
• IP address: 162.220.163[.]26

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

Technical analysis

Bitdefender's Threat Debrief for October 2026 (published 2026-11-10) analyses data-leak-site (DLS) claims: 1,072 claimed victims, or 946 after removing 126 attributed to the new actor N0n. Bitdefender stresses that DLS counts are unreliable and that claims often lack validity at first. The debrief names no CVEs, hashes or IOCs; the technical indicators below come from the cited third-party research (SOCRadar, CloudSEK, Cybernews, The Register) and are attributed to those sources.

N0n emerged in mid-September 2026 and ran a leak site (categories pending/exposed/leaked/honors) listing 100+ victims, although server evidence indicates only about 20-23 real targets, with duplicates and false entries from poor site maintenance. Its Python HTTP file server (185.157.161.148:8877, Sweden-associated) was left open with browsable directories. SOCRadar recorded 1,719 files in snapshots on 25-26 September, containing attack scripts, ransomware source code, extortion infrastructure and an AI coding agent environment. OpenCode was configured with 154 model entries across seven providers, including uncensored models. Reported AI spend exceeded $7,216 by 22 October. SOCRadar reports no vulnerability exploitation: access came from weak or stolen credentials, RDP scanning, FortiGate SSL-VPN credential stuffing (GET /remote/login via a residential SOCKS5 proxy pool), exposed AWS keys and reused hosting-portal sessions. Persistence used hidden admin accounts disguised as services and covert proxies. The encryptor contains hardcoded keys reused across victims, which may aid decryption. On 12 October the group posted 38 maritime, port and logistics organisations from 18 countries in one batch, with demands of $400,000-$28 million; Cydome linked at least 21 to customers of the South Korean provider CyberLogitec, which has not confirmed an intrusion. N0n inflated South Korea (11 victims) and transportation (20 victims) statistics. SOCRadar assesses a single operator or small team, believed Russia-based without definitive attribution.

Azazel is a Russian-speaking Gentlemen RaaS affiliate that, per CloudSEK, split from the operator, ran the independent LEAKNED leak site and allegedly diverted extortion proceeds (not independently confirmed). Reporting cites 24+ victims in six countries and roughly 6 TB of stolen data (Cybernews cited 3.1 TB from 30+ companies). Initial access used stolen GitLab CI/CD variables and git history (Chain A) or SSRF through an unauthenticated AI medical-imaging API (Chain B). The actor decrypted Jasypt secrets, cracked Grafana admin hashes, pivoted with stolen SSH keys and container escape, used an OverlayFS SUID privilege escalation, and abused PostgreSQL UDF and Redis CONFIG SET dir/SAVE to plant SSH keys. Data was exfiltrated with aws s3 sync, MinIO mc mirror, scp, pg_dump and HTTP POST to port 9999, staged on a bare-metal host and pushed to MEGA. The Penelope reverse-shell framework was exposed to an AI coding assistant through an MCP server (exec_in_session calls to 127.0.0.1:35367 with a fixed bearer token, driven by va.py; MCP client identity 'hermes'; scanner fingerprint 'internet-census-mcp-scanner'). Impact included killing live PostgreSQL and deleting production data directories, and ransom notes were dropped across eight surfaces on six hosts.

BYOD emerged in September 2026, targets enterprises in North America and Southeast Asia, and claimed the University of New Mexico health system in late October 2026 (ambulance diversions and cancelled surgeries reported). It then apologised, offered free decryptors and offered patient compensation of up to $2,500 and a $2,500 payment to destroy data; Bitdefender considers such offers possible ploys to prolong the compromise. UNM has not confirmed ransomware or BYOD's claim of 36,000 devices. Booba Team (tracked by SOCRadar as Booba Project, emerged July 2026) claimed more than nine government organisations and over 800 GB, limited to the US and South America (e.g., Washington County and Merrimack County listings of 2026-09-23). Bitdefender also notes 17+ newcomer groups in two months, healthcare rising to second-ranked industry, and transportation rising from 10th to 6th because of N0n.

Defender takeaways: AI agents and MCP now serve as operational C2 and script-generation tooling, but the underlying intrusion paths remain credential abuse, exposed CI/CD secrets, exposed VPN/RDP and unmanaged cloud keys.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 SSH

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration to Cloud Storage

Execution

T1059.004 Unix Shell; T1059.006 Python

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Command and Control

T1090 Proxy

Credential Access

T1110.002 Password Cracking; T1110.004 Credential Stuffing; T1552.001 Credentials In Files; T1552.004 Private Keys

Persistence

T1136.001 Local Account

Collection

T1213.003 Code Repositories; T1530 Data from Cloud Storage

Impact

T1485 Data Destruction; T1490 Inhibit System Recovery

Reconnaissance

T1595.002 Vulnerability Scanning

Privilege Escalation

T1611 Escape to Host

Remediation

Immediate actions

• Block and hunt the network IOCs listed (23.236.169.183, 162.220.163.26, 66.179.30.155, 141.95.252.30, 66.203.124.135, 185.157.161.148)
• Rotate GitLab CI/CD variables, deploy tokens, SSH keys and cloud keys; audit git history, including commits removed from current branches, for committed secrets
• Enforce MFA and review SSL-VPN and RDP logs for credential-stuffing patterns (GET /remote/login bursts from residential proxy IPs)
• Alert on bulk MinIO 'mc mirror', 'aws s3 sync' and uploads to MEGA from servers

Workarounds

• Restrict PostgreSQL COPY TO PROGRAM and Redis CONFIG SET
• Restrict RDP exposure and require VPN
• Keep Jasypt keys and kubeconfigs out of application configs

Longer-term hardening

• Move CI/CD secrets into a dedicated secrets manager and alert on unusual CI/CD variable reads
• Bind MCP servers to strict loopback and allowlist MCP client identities; monitor for local agent-to-shell bridges
• Keep backups and backup credentials on separate infrastructure and test restores regularly
• Maintain an inventory of assets and data, including data in open repositories
• Verify leak-site claims before assuming data theft is current or valid

Affected and fixed versions

• Fortinet — FortiGate SSL-VPN (credential stuffing, no vulnerability)
• GitLab — GitLab CI/CD variables and repository history (secret exposure)
• Amazon — AWS S3 / IAM access keys (exposed credentials)
• Microsoft — Remote Desktop Protocol (exposed services)

Timeline

• 2026-07-01 Booba Project/Booba Team emerges (SOCRadar: July 2026), focusing on government and professional services.
• 2026-09-15 N0n emerges in mid-September 2026 and starts a leak site; BYOD also emerges in September (exact dates not stated).
• 2026-09-23 Booba Project lists Washington County and Merrimack County (US) on its leak site.
• 2026-09-26 SOCRadar snapshots N0n's exposed Python file server on 25-26 September, recording 1,719 files including scripts, ransomware source and an AI agent environment.
• 2026-10-12 N0n posts 38 maritime, port and logistics organisations across 18 countries, demanding $400,000-$28 million with a 19 October deadline.
• 2026-10-22 SOCRadar reports N0n's generative-AI spend exceeded $7,216 by 22 October.
• 2026-10-26 BYOD claims the University of New Mexico health system (late October, exact date not given); UNM Hospital reopens by 27 October. BYOD offers free decryptors and up to $2,500 in patient compensation.
• 2026-10-30 The Register publishes the N0n exposure story, the earliest dated public report of N0n's AI spend and exposed server.
• 2026-11-10 Bitdefender publishes its debrief for October 2026: 1,072 claimed victims, 946 excluding N0n's 126.

Sources cited

• RH-ISAC: Gentlemen ransomware affiliate utilizes MCP in multi-sector cyberattacks rhisac.org · Advisory
• Bitdefender Threat Debrief: November 2026 bitdefender.com · Vendor report · 2026-11-10
• SOCRadar: n0n Ransomware AI-assisted Extortion socradar.io · Research
• CloudSEK: Caught in 4K - The Gentlemen Files cloudsek.com · Research
• SOCRadar: Washington County Data Breach (Booba Project) socradar.io · Research · 2026-09-23
• Bitdefender Ransomware Threat Debrief: October 2026 bitdefender.com · Vendor report
• Fortra: What Is n0n? fortra.com · Blog
• Fortra: BYOD cyberattack diverts ambulances and cancels classes at UNM health center fortra.com · Blog
• The Register: Crim spent $7k on AI services in extortion attacks, then left evidence for all to see The Register · News · 2026-10-30
• Cybernews: Hacker caught double-crossing The Gentlemen ransomware gang cybernews.com · News
• Daily Security Review: Gentlemen Ransomware Affiliate Used MCP as Command Channel dailysecurityreview.com · News
• The Record: UNM cyberattack The Record · News
• Dexpose: Booba Project Strikes The Merrimack County dexpose.io · News

More in ransomware

• Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)
• MedusaLocker ransomware leak-site listing: victim 'Capetown' (identity unverified)
• Sophos State of Ransomware in Retail 2026: Exploited Vulnerabilities Lead Retail Root Causes, Encryption Rate Rises to 62%
• Vortex ransomware group claims Scripps (US healthcare) on leak site
• Vanderbilt University hit in BYOD ransomware attack, data theft claimed

More from Azazel

• Azazel: Gentlemen Ransomware Affiliate Compromises 24+ Organizations via Stolen CI/CD Secrets, Abuses MCP as C2 and Runs LEAKNED Leak Site

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors