This is an Ingenious AI security check — part of the free Ingenious AI checks and tools suite.
CloudSEK’s “Caught in 4K: The Gentlemen Files” investigation (published October 6, 2026) documents a first: a Russian-speaking affiliate of the Gentlemen ransomware group, Azazel, used MCP tooling as a command-and-control channel in a live criminal campaign — calling exec_in_session against a locally-bound MCP server to run attack operations, while internet-wide scanning hunted exposed MCP ports. More than two dozen organizations, roughly 6TB of data. Your MCP fleet has the same primitives. Eight questions will tell you whether it could be abused the same way. Free, no signup.
Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
exec_in_session tool as a live C2 channel — a script looping SSH checks across six internal hosts through 127.0.0.1:35367 with a fixed bearer token — plus internet-wide scanning for exposed MCP ports under the fingerprint internet-census-mcp-scanner. Stop the same abuse of your fleet: bind MCP ports to localhost only, add egress controls, log every tool call, run anomaly detection on call patterns, and scan your own estate for exposed MCP ports.
exec_in_session as a C2 channel in a live criminal campaign, per CloudSEK.va.py (a ransom-note verification script) called 127.0.0.1:35367 with a fixed bearer token, looping SSH verification checks across six internal hosts. Companion scripts mcp_test.py and recon_mcp.py show developed, iterated tooling — not a one-off. The beacon log showed internet-wide scanning under the fingerprint internet-census-mcp-scanner, treating exposed MCP ports as a general-purpose initial-access vector.A “Yes” means the control is in place; a “No” is an opening for C2-style abuse.
1. Are your MCP server ports bound to localhost only, never exposed to the network?
2. Do you have egress controls (firewall / proxy) restricting what your MCP tool servers can reach?
3. Is every tool call logged centrally with timestamps, arguments, and the calling session?
4. Do you run anomaly detection (or at least periodic review) on tool-call patterns — odd hours, new destinations, repeated exec loops?
5. Are bearer tokens / auth secrets for local MCP services rotated and scoped, not hardcoded in scripts?
6. Is exec_in_session / shell-execution tooling disabled or gated behind approval on production agents?
7. Do you scan your own estate for internet-exposed MCP ports — the very thing the Gentlemen affiliate was scanning for?
8. Would your monitoring distinguish a criminal’s exec_in_session loop from normal agent traffic?
This checker is a guided self-assessment of your fleet controls. It cannot scan your network or detect active abuse.
exec_in_session is a feature. An attacker who reaches one doesn’t need to smuggle in malware; the execution primitive is already there.127.0.0.1 — inside the victim environment. Perimeter firewalls never see it; only internal segmentation and egress controls do.internet-census-mcp-scanner fingerprint shows attackers scanning the whole internet for MCP ports as a general-purpose initial-access vector. Every exposed MCP server is a standing invitation.internet-census-mcp-scanner does.'Caught in 4K: The Gentlemen Files' is a CloudSEK investigation published October 6, 2026. It documents Azazel, a Russian-speaking affiliate of the Gentlemen ransomware group, who compromised more than two dozen organizations and exfiltrated roughly 6TB of data. The investigation is notable for documenting the first confirmed operational use of MCP tooling as a command-and-control channel in a live criminal campaign.
“Caught in 4K: The Gentlemen Files” is a CloudSEK investigation published October 6, 2026. It documents Azazel, a Russian-speaking affiliate of the Gentlemen ransomware group, who compromised more than two dozen organizations and exfiltrated roughly 6TB of data. The investigation is notable for documenting the first confirmed operational use of MCP tooling as a command-and-control channel in a live criminal campaign.
Per CloudSEK: the operator’s va.py script — a ransom-note verification script — called a locally-bound MCP server at 127.0.0.1:35367 with a fixed bearer token to loop SSH verification checks across six internal hosts. Companion scripts (mcp_test.py, recon_mcp.py) showed this was developed, iterated tooling, not a one-off. The beacon log also showed internet-wide scanning under the fingerprint “internet-census-mcp-scanner,” hunting exposed MCP server ports as an initial-access vector.
According to CloudSEK, the security research community had documented MCP attack risks since 2025 — tool poisoning, prompt injection, supply-chain abuse — but CloudSEK “has not identified prior public reporting of a threat actor operationally using MCP exec_in_session as a C2 channel in a live criminal campaign.” This investigation documents one confirmed instance.
Bind MCP server ports to localhost only and never expose them to the network. Add egress controls on tool servers. Log every tool call centrally with timestamps, arguments, and sessions. Run anomaly detection on tool-call patterns. Rotate bearer tokens, gate shell-execution tooling behind approval, and scan your own estate for exposed MCP ports — the thing the Gentlemen affiliate was scanning for. The 8-question checker on this page grades your posture.
Per CloudSEK, it is the beacon fingerprint from the Gentlemen affiliate’s tooling that scanned the internet at global scale hunting exposed MCP server ports — treating them as a general-purpose initial-access vector. If your threat-intel feeds or scan logs show that fingerprint, someone is probing for exactly the MCP servers this page helps you lock down.
Informational only: this page reflects the CloudSEK “Gentlemen Files” investigation (published 2026-10-06). Not a security audit.
Filed under Cybersecurity News by Ingenious AI — see the related checks above for more in this series.