Hunt.io found a live TheGentlemen ransomware toolkit on Russian Proton66 infrastructure, including victim credentials, Mimikatz logs, and plaintext ngrok tokens.