With synthetic intelligence (AI) shrinking the window between vulnerability discovery and exploitation and decreasing the barrier to entry for unhealthy actors, new findings from Sysdig present that expert human operators can transfer simply as swiftly after gaining preliminary entry.
In a single occasion highlighted by the cloud safety firm, the risk actor pivoted from a weak Marimo pocket book to an SSH bastion host in eight seconds utilizing a customized Python toolkit they “wrote and debugged by hand” with none AI agent within the loop.
“Eight seconds is the type of pace we anticipate to see in AI-assisted assaults,” the Sysdig Menace Analysis Group mentioned. “This operator acquired there on ability alone, and alongside the way in which walked straight previous a lure that each agentic risk actor (ATA) we have profiled in opposition to this identical CVE fell into. Not solely can expert human attackers transfer at machine pace, however they’ll additionally usually higher evade defenders’ detections.”
The assault chain has been discovered to use CVE-2026-39987 (CVSS rating: 9.3), a pre-authenticated distant code execution vulnerability impacting all variations of Marimo that got here beneath energetic exploitation inside hours of public disclosure.
Upon gaining an preliminary foothold, the risk actor is alleged to have run an end-to-end credential-pivot chain, leveraging the Marimo flaw to realize a full interactive shell, adopted by an Amazon Net Providers (AWS) Secrets and techniques Supervisor name utilizing credentials harvested from the compromised occasion, and SSH entry to a bastion host with the retrieved personal key –
- 18:57:22: Recent WebSocket connection
- 18:57:26: Lookup in opposition to the applying’s saved credential returns the harvested AWS key
- 18:57:30: SSH authentication noticed on the bastion host
The whole exercise lasted from 12:52 p.m., when the primary WebSocket connection was created from “172.236.12[.]17” to the “/terminal/ws WebSocket endpoint uncovered by Marimo, to 9:50 p.m., throughout which the risk actor deployed an asyncssh-style listener setup in opposition to an attacker-owned VPS.
“Over the course of a nine-hour session, they issued greater than 850 interactive instructions, used no recognizable publicly obtainable offensive tooling, and hand-rolled their scripts in-session,” Sysdig mentioned. “The operator’s tradecraft converged on a single backgrounded Python3 invocation, not an agentic framework, that pulls the credential, fetches the SSH key from Secrets and techniques Supervisor, writes it to disk, and authenticates to the bastion over SSH in a single shot.”
“AI could also be altering the economics of assaults — extra targets, quicker time-to-exploit, and fewer handbook grind on repetitive duties — however it has not but changed the expert attacker who is aware of learn how to construct from scratch and keep away from traps.”
The findings come as Hunt.io disclosed particulars of a cryptomining marketing campaign that has compromised 3,562 Redis servers possible following a broad web sweep of candidate Redis hosts on port 6379, whereas concurrently launching three parallel pipelines –
- WordPress goal discovery, which scans a listing of HTTPS hosts for WordPress model, put in plugins, and whether or not XML-RPC or listing listings are uncovered
- AOF-based SSH authorized_keys injection, which makes use of Redis’s append-only file (AOF) mode to carry out authorized_keys SSH key injection
- Lua sandbox-escape probing, which runs Redis EVAL instructions and sandbox escape makes an attempt in opposition to three hosts (“47.250.92[.]230,” “34.166.99[.]116,” and “20.198.10[.]42”)
The first exploitation methodology is using the SLAVEOF command to smuggle attacker-controlled content material onto a goal Redis server, ensuing within the deployment of an XMRig miner. The exercise, which got here to gentle after the invention of an uncovered working atmosphere at 188.245.99[.]156, has not been attributed to any identified risk actor or group.
“Confirmed victims span Redis 2.8.17 (2015) by way of 7.2.0 (2023) and Linux from EOL RHEL/CentOS 6 to present Ubuntu kernels, pointing to lacking authentication because the weak spot reasonably than a version-specific bug,” Hunt.io mentioned.
“The toolkit runs 4 methods throughout three providers, however solely Redis rogue replication labored at scale: SSH key-injection and MongoDB sandbox-escape returned zero throughout 2,810 makes an attempt, and an entire WordPress credential-to-webshell chain was recovered however not confirmed at scale.”
In latest months, a single operator was additionally linked to an enormous marketing campaign dubbed Operation CameraSwarm that compromised over 14,000 Dahua IP cameras utilizing brute-force assaults, authentication bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a peer-to-peer (P2P) relay approach.
