# Bitdefender Threat Debrief Nov 2026: AI-assisted ransomware actors N0n and Azazel (MCP reverse-shell C2), BYOD, Booba Team

> Bitdefender's debrief for October 2026 reports 1,072 claimed ransomware victims (946 excluding N0n's dataset). N0n used the OpenCode AI coding agent (>$7,000 of generative AI spend) to build scanning/recon scripts and reuses hardcoded encryption keys; Azazel, a Gentlemen RaaS affiliate, drove a Penelope reverse shell through MCP from an AI coding assistant as a C2 channel and harvested GitLab CI/CD secrets.

- **Published:** 2026-11-10T09:57:20Z
- **Last reviewed:** 2026-11-10T09:57:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5634
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5634.png
- **ID:** TL-2026-5634
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Azazel
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Bitdefender's Threat Debrief for October 2026 (published 2026-11-10) analyses data-leak-site (DLS) claims: 1,072 claimed victims, or 946 after removing 126 attributed to the new actor N0n. Bitdefender stresses that DLS counts are unreliable and that claims often lack validity at first. The debrief names no CVEs, hashes or IOCs; the technical indicators below come from the cited third-party research (SOCRadar, CloudSEK, Cybernews, The Register) and are attributed to those sources.

N0n emerged in mid-September 2026 and ran a leak site (categories pending/exposed/leaked/honors) listing 100+ victims, although server evidence indicates only about 20-23 real targets, with duplicates and false entries from poor site maintenance. Its Python HTTP file server (185.157.161.148:8877, Sweden-associated) was left open with browsable directories. SOCRadar recorded 1,719 files in snapshots on 25-26 September, containing attack scripts, ransomware source code, extortion infrastructure and an AI coding agent environment. OpenCode was configured with 154 model entries across seven providers, including uncensored models. Reported AI spend exceeded $7,216 by 22 October. SOCRadar reports no vulnerability exploitation: access came from weak or stolen credentials, RDP scanning, FortiGate SSL-VPN credential stuffing (GET /remote/login via a residential SOCKS5 proxy pool), exposed AWS keys and reused hosting-portal sessions. Persistence used hidden admin accounts disguised as services and covert proxies. The encryptor contains hardcoded keys reused across victims, which may aid decryption. On 12 October the group posted 38 maritime, port and logistics organisations from 18 countries in one batch, with demands of $400,000-$28 million; Cydome linked at least 21 to customers of the South Korean provider CyberLogitec, which has not confirmed an intrusion. N0n inflated South Korea (11 victims) and transportation (20 victims) statistics. SOCRadar assesses a single operator or small team, believed Russia-based without definitive attribution.

Azazel is a Russian-speaking Gentlemen RaaS affiliate that, per CloudSEK, split from the operator, ran the independent LEAKNED leak site and allegedly diverted extortion proceeds (not independently confirmed). Reporting cites 24+ victims in six countries and roughly 6 TB of stolen data (Cybernews cited 3.1 TB from 30+ companies). Initial access used stolen GitLab CI/CD variables and git history (Chain A) or SSRF through an unauthenticated AI medical-imaging API (Chain B). The actor decrypted Jasypt secrets, cracked Grafana admin hashes, pivoted with stolen SSH keys and container escape, used an OverlayFS SUID privilege escalation, and abused PostgreSQL UDF and Redis CONFIG SET dir/SAVE to plant SSH keys. Data was exfiltrated with aws s3 sync, MinIO mc mirror, scp, pg_dump and HTTP POST to port 9999, staged on a bare-metal host and pushed to MEGA. The Penelope reverse-shell framework was exposed to an AI coding assistant through an MCP server (exec_in_session calls to 127.0.0.1:35367 with a fixed bearer token, driven by va.py; MCP client identity 'hermes'; scanner fingerprint 'internet-census-mcp-scanner'). Impact included killing live PostgreSQL and deleting production data directories, and ransom notes were dropped across eight surfaces on six hosts.

BYOD emerged in September 2026, targets enterprises in North America and Southeast Asia, and claimed the University of New Mexico health system in late October 2026 (ambulance diversions and cancelled surgeries reported). It then apologised, offered free decryptors and offered patient compensation of up to $2,500 and a $2,500 payment to destroy data; Bitdefender considers such offers possible ploys to prolong the compromise. UNM has not confirmed ransomware or BYOD's claim of 36,000 devices. Booba Team (tracked by SOCRadar as Booba Project, emerged July 2026) claimed more than nine government organisations and over 800 GB, limited to the US and South America (e.g., Washington County and Merrimack County listings of 2026-09-23). Bitdefender also notes 17+ newcomer groups in two months, healthcare rising to second-ranked industry, and transportation rising from 10th to 6th because of N0n.

Defender takeaways: AI agents and MCP now serve as operational C2 and script-generation tooling, but the underlying intrusion paths remain credential abuse, exposed CI/CD secrets, exposed VPN/RDP and unmanaged cloud keys.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1110.004 Credential Stuffing
- T1110.002 Password Cracking
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1059.006 Python
- T1059.004 Unix Shell
- T1136.001 Local Account
- T1611 Escape to Host
- T1021.004 SSH
- T1021.001 Remote Desktop Protocol
- T1213.003 Code Repositories
- T1530 Data from Cloud Storage
- T1090 Proxy
- T1048 Exfiltration Over Alternative Protocol
- T1567.002 Exfiltration to Cloud Storage
- T1485 Data Destruction
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Azazel Linux Post-Exploitation: Redis/PostgreSQL Abuse, OverlayFS Privesc and Container Escape** (`TL-2026-5634-SPL-002`)

Detects Linux post-exploitation behaviours attributed to Azazel by CloudSEK: Redis CONFIG SET dir/dbfilename used to plant SSH keys, PostgreSQL COPY TO PROGRAM command execution, OverlayFS user-namespace privilege escalation, SUID/capability planting in world-writable paths, and container escape to the host (nsenter into PID 1 or privileged container with host root mounted).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1068, T1611, T1021.004
- **Data sources:** sysmon_for_linux (index=linux sourcetype=sysmon:linux), DeviceProcessEvents (Defender for Endpoint on Linux), linux process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=linux sourcetype="sysmon:linux" EventCode=1
``` Azazel TL-2026-5634 Linux post-exploitation: Redis, PostgreSQL, OverlayFS, container escape ```
| eval cmd=lower(CommandLine)
| eval technique=case(
    match(cmd,"redis-cli") AND match(cmd,"config\\s+set\\s+(dir|dbfilename)"), "Redis CONFIG SET dir/dbfilename SSH key planting",
    match(cmd,"psql|pg_ctl") AND match(cmd,"copy\\s.{1,200}\\sto\\s+program"), "PostgreSQL COPY TO PROGRAM command execution",
    match(cmd,"unshare") AND match(cmd,"overlay"), "OverlayFS user-namespace privilege escalation",
    match(cmd,"nsenter\\s.*(-t|--target)\\s+1\\s") OR (match(cmd,"--privileged") AND match(cmd,"-v\\s+/:/")), "Container escape to host",
    match(cmd,"(chmod|setcap)") AND match(cmd,"(u\\+s|4755|6755|cap_setuid)") AND match(cmd,"(/tmp/|/dev/shm/|/var/tmp/)"), "SUID or capability planted in world-writable path")
| where isnotnull(technique)
| stats count AS events values(CommandLine) AS commands values(ParentImage) AS parents min(_time) AS first_seen max(_time) AS last_seen by host User technique
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Cmd = tolower(ProcessCommandLine)
| extend Technique = case(
    Cmd has "redis-cli" and Cmd matches regex @"config\s+set\s+(dir|dbfilename)", "Redis CONFIG SET dir/dbfilename SSH key planting",
    Cmd has_any ("psql", "pg_ctl") and Cmd matches regex @"copy\s.{1,200}\sto\s+program", "PostgreSQL COPY TO PROGRAM command execution",
    Cmd has "unshare" and Cmd has "overlay", "OverlayFS user-namespace privilege escalation",
    Cmd matches regex @"nsenter\s.*(-t|--target)\s+1\s" or (Cmd has "--privileged" and Cmd matches regex @"-v\s+/:/"), "Container escape to host",
    Cmd has_any ("chmod", "setcap") and Cmd has_any ("u+s", "4755", "6755", "cap_setuid") and Cmd has_any ("/tmp/", "/dev/shm/", "/var/tmp/"), "SUID or capability planted in world-writable path",
    "")
| where Technique != ""
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Technique
```

### Sigma

```yaml
title: Linux Redis, PostgreSQL and Container-Escape Abuse (Azazel TL-2026-5634)
id: 9a4c7e21-3d58-4b96-8f10-6e2b1c5d7a03
status: experimental
description: Detects Redis CONFIG SET dir/dbfilename, PostgreSQL COPY TO PROGRAM, OverlayFS user-namespace privilege escalation, container escape via nsenter or privileged containers, and SUID/capability planting in world-writable paths, as reported for the Azazel Gentlemen RaaS affiliate.
references:
    - https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.execution
    - attack.t1059.004
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1611
    - attack.lateral_movement
    - attack.t1021.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_redis:
        Image|endswith: '/redis-cli'
        CommandLine|contains:
            - 'config set dir'
            - 'config set dbfilename'
    selection_pg:
        Image|endswith: '/psql'
        CommandLine|contains|all:
            - ' copy '
            - ' to program'
    selection_overlay:
        CommandLine|contains|all:
            - 'unshare'
            - 'overlay'
    selection_nsenter:
        CommandLine|contains:
            - 'nsenter --target 1 '
            - 'nsenter -t 1 '
    selection_privileged:
        CommandLine|contains|all:
            - '--privileged'
            - ' -v /:/'
    suid_bits:
        Image|endswith:
            - '/chmod'
            - '/setcap'
        CommandLine|contains:
            - 'u+s'
            - ' 4755 '
            - ' 6755 '
            - 'cap_setuid'
    suid_path:
        CommandLine|contains:
            - '/tmp/'
            - '/dev/shm/'
            - '/var/tmp/'
    condition: 1 of selection_* or (suid_bits and suid_path)
falsepositives:
    - Database administrators using psql COPY TO PROGRAM or redis-cli CONFIG SET on maintenance windows
    - Container platform and debugging tooling that uses nsenter or privileged containers
level: high
```

**Known false positives:**

- DBAs running redis-cli CONFIG SET or psql COPY TO PROGRAM during maintenance
- Container tooling and troubleshooting using nsenter or privileged containers

**Tuning notes:** Scope to database, Kubernetes node and CI runner hosts first; allowlist known DBA accounts and orchestration parent processes (kubelet, containerd-shim); alert on Redis CONFIG SET dir pointing at .ssh paths with higher priority. Redis commands sent over raw sockets rather than redis-cli are not covered; add Redis server command logging if available.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Exposed AWS Access Key Abuse: S3 Enumeration and Bulk Reads or Known N0n/Azazel Source IPs (locked: unlock with TL Creds)
- CI/CD Secret Harvesting Tooling: nord-stream, glato, gitlab-watchman, gitleaks, Jasypt Decryption (locked: unlock with TL Creds)
- Azazel Bulk Exfiltration: mc mirror, aws s3 sync, MEGA Upload, Port 9999 POST and N0n/Azazel Infrastructure (locked: unlock with TL Creds)
- RDP Logon From Public IP Address (Exposed RDP Initial Access, n0n) (locked: unlock with TL Creds)
- Hidden or Service-Disguised Local Admin Account Creation (N0n Persistence) (locked: unlock with TL Creds)
- Azazel Impact: Ransom Note Drop, PostgreSQL Data Directory Deletion and Backup Removal (locked: unlock with TL Creds)
- n0n FortiGate SSL-VPN Credential Stuffing (GET /remote/login) - TL-2026-5634 (locked: unlock with TL Creds)
- Azazel MCP Reverse-Shell C2: Penelope exec_in_session and AI-Agent-to-Shell Bridge (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `23.236.169[.]183`
- Domain: `forgitlab[.]com`
- IP address: `162.220.163[.]26`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Bitdefender Threat Debrief: November 2026](https://www.bitdefender.com/en-gb/blog/businessinsights/bitdefender-threat-debrief-november-2026)
- [The Register: Crim spent $7k on AI services in extortion attacks, then left evidence for all to see](https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754)
- [SOCRadar: n0n Ransomware AI-assisted Extortion](https://socradar.io/blog/n0n-ransomware-ai-assisted-extortion/)
- [Fortra: What Is n0n?](https://fortra.com/blog/n0n-ransomware-what-you-need-know)
- [CloudSEK: Caught in 4K - The Gentlemen Files](https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files)
- [RH-ISAC: Gentlemen ransomware affiliate utilizes MCP in multi-sector cyberattacks](https://rhisac.org/threat-intelligence/the-gentlemen-ransomware-affiliate-utilizes-mcp-in-multi-sector-cyberattacks/)
- [Cybernews: Hacker caught double-crossing The Gentlemen ransomware gang](https://cybernews.com/cybercrime/gentlemen-ransomware-affiliate-double-cross-ai-attack/)
- [Daily Security Review: Gentlemen Ransomware Affiliate Used MCP as Command Channel](https://dailysecurityreview.com/ransomware/gentlemen-ransomware-affiliate-used-mcp-as-command-channel/)
- [The Record: UNM cyberattack](https://therecord.media/new-mexico-cyberattack-hospital)
- [Fortra: BYOD cyberattack diverts ambulances and cancels classes at UNM health center](https://www.fortra.com/blog/byod-cyberattack-diverts-ambulances-and-cancels-classes-university-new-mexico-health-center)
- [SOCRadar: Washington County Data Breach (Booba Project)](https://socradar.io/data-breach/washington-county-booba-project-ransomware-2026/)
- [Dexpose: Booba Project Strikes The Merrimack County](https://www.dexpose.io/booba-project-strikes-the-merrimack-county/)
- [Bitdefender Ransomware Threat Debrief: October 2026](https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-ransomware-threat-debrief-october-2026)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5634