A fully operational ransomware toolkit linked to the “TheGentlemen” group has been discovered on an exposed server, revealing sensitive victim credentials, ngrok authentication tokens, and a complete pre-encryption attack playbook. The exposed infrastructure provides rare insight into how modern ransomware campaigns are executed, highlighting the growing sophistication of ransomware-as-a-service (RaaS) ecosystems.
The server, hosted at 176.120.22[.]127:80 by Russian bulletproof hosting provider Proton66 OOO, was found to contain 126 files across 18 directories, totaling approximately 140 MB of data. Security researchers identified the open directory in mid-March 2026, noting that it had been publicly accessible for several weeks, indicating active and recent use rather than abandoned infrastructure.
Proton66 has previously been associated with multiple cybercriminal operations, including SuperBlack ransomware, WeaXor, and XWorm, reinforcing its role as a key enabler within the ransomware ecosystem. The exposure of this server underscores how threat actors continue to rely on resilient, unregulated hosting services to maintain operational continuity.
The contents of the server revealed a highly structured toolkit designed to support every stage of a ransomware attack lifecycle. Key directories included tools for 64-bit Windows systems, privilege escalation utilities, and a dedicated Mimikatz environment used for credential harvesting. Additional binaries such as PC Hunter, PowerTool, RustDesk, ngrok, and 7-Zip were also present, forming a comprehensive attack toolkit.
Analysis of the files showed that the toolkit was not theoretical but actively used in real-world attacks. Logs stored within the Mimikatz directories contained NTLM password hashes, usernames, and other sensitive credential data from previously compromised systems. This confirms that the exposed infrastructure was part of ongoing ransomware operations rather than a testing environment.
Further investigation uncovered hardcoded ngrok authentication tokens embedded within scripts and configuration files. These tokens could potentially allow defenders or law enforcement agencies to trace attacker activity or disrupt remote access channels if acted upon quickly. The presence of both credential data and active tokens creates a direct link between the toolkit and live intrusion campaigns.
At the core of the toolkit is a powerful batch script named z1.bat, designed as a one-click pre-encryption deployment mechanism. The script automates multiple stages of attack preparation, including disabling security tools, stopping enterprise services, and weakening system defenses. It specifically targets antivirus solutions, database services, backup systems, and enterprise applications to eliminate protections and remove file locks.
The script also aggressively disables Windows Defender through registry modifications and policy changes, while simultaneously deleting logs and scan histories to erase evidence of compromise. It further expands access within infected environments by creating open SMB shares with unrestricted permissions, enabling rapid lateral movement across networks.
To complete the attack preparation, z1.bat executes extensive anti-forensics measures, including wiping Windows event logs, clearing remote desktop history, and deleting files from the Recycle Bin. These steps ensure minimal traceability before the ransomware payload is deployed.
Security analysis mapped the toolkit’s behavior to 21 MITRE ATT&CK techniques, covering reconnaissance, privilege escalation, credential theft, lateral movement, persistence, and defense evasion. This comprehensive coverage highlights the level of planning and automation involved in modern ransomware campaigns.
The exposure of this server offers a detailed, end-to-end view of how ransomware affiliates prepare victim environments prior to encryption. The use of advanced tools and automated scripts demonstrates a strong focus on scalability, reliability, and evasion of endpoint defenses.
Organizations are advised to take proactive measures to defend against similar threats. Monitoring infrastructure linked to Proton66, detecting unauthorized ngrok tunnels, and identifying unusual service shutdown activity can provide early warning signs of compromise. Additionally, enforcing strict access controls, rotating credentials regularly, and hardening remote access systems such as RDP can significantly reduce the risk of successful attacks.
This incident highlights the evolving nature of ransomware operations, where well-organized toolkits and exposed infrastructure can offer defenders valuable intelligence – if identified and acted upon in time.
Recommended Cyber Technology News :
- Linux Ransomware Pay2Key Targets Cloud & Servers
- Cisco Firewall 0-Day Exploited to Deploy Ransomware
- Google Warns of Ransomware Shift Toward Data Theft
To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com
