Exposed server leaks TheGentlemen ransomware toolkit, victim credentials, and ngrok tokens

An exposed server has revealed what looks like the full working toolkit of a TheGentlemen ransomware affiliate, giving defenders a rare look at how one operator prepared systems for encryption, disabled defenses, and maintained remote access. Hunt.io said the open directory sat on infrastructure tied to Proton66, a Russia-linked bulletproof hosting provider, and contained both attack tools and data tied to real victim activity.

The leak matters because it does not show a single malware sample in isolation. It shows how an affiliate appears to move from initial access to full ransomware deployment, with scripts for defense evasion, credential theft, persistence, and remote tunnel setup already staged on one exposed server.

TheGentlemen itself is not a fringe name at this point. Trend Micro described the group in September 2025 as a ransomware operation that uses legitimate tools, privilege escalation, and environment-specific evasion to move quickly inside victim networks, while FortiGuard now tracks The Gentlemen as an active ransomware threat actor that targets organizations with double-extortion tactics.

What the exposed server reportedly contained

According to Hunt.io, the exposed system was reachable at 176.120.22[.]127 over port 80 and had been live long enough to hold a substantial archive of operational material. The directory reportedly contained about 140 MB of data, including scripts, logs, and configuration files with sensitive tokens.

The most important file was z1.bat, a large pre-ransomware deployment script that Hunt.io said bundled together many of the steps attackers usually perform right before encryption. The report says the script disabled or removed security products, stopped enterprise services, opened SMB shares, enabled remote access, weakened Windows protections, deleted shadow copies, and cleared event logs to make recovery harder.

Your sample also notes that the server held Mimikatz logs, plaintext ngrok authentication tokens, and evidence of real-world deployment rather than unused tooling. Hunt.io’s findings align with that description, which makes this leak especially serious because it suggests the infrastructure had already supported live intrusions, not just testing or staging.

Why defenders should pay attention

Security teams should treat this leak as a practical map of affiliate behavior. Hunt.io says defenders should watch for bulk service disabling, Windows Defender tampering, IFEO debugger changes on accessibility binaries, WDigest-related registry activity, LSASS access tied to credential theft, mass network share creation, and vssadmin shadow copy deletion.

Those recommendations line up with long-standing government guidance. CISA’s StopRansomware guide urges organizations to harden backups, segment networks, enforce MFA, patch exposed services, and prepare incident response procedures before an attack hits, while its response checklist tells victims to isolate affected systems immediately and preserve forensic evidence.

The wider lesson is simple. Ransomware crews no longer rely only on the final encryptor to do damage. They build repeatable pre-encryption workflows that disable security controls, weaken recovery options, and leave defenders racing against a process that can unfold in hours. That is exactly why exposed affiliate infrastructure like this gives defenders useful insight even when the operators themselves remain active.

Key takeaways

• Hunt.io said the exposed server sat on Proton66 infrastructure and contained 126 files across 18 directories.
• The leaked material reportedly included victim credentials, Mimikatz logs, and ngrok tokens.
• The z1.bat script appeared designed to disable defenses and prepare systems for fast ransomware deployment.
• Trend Micro and FortiGuard have both documented The Gentlemen as an active ransomware threat.
• CISA recommends isolation, backup protection, MFA, segmentation, and response planning to reduce ransomware impact.

Indicators and behaviors to watch

FAQ