Shai Hulud-Linked Intrusion Escalated From Jenkins Credentials to AWS Redshift Data Theft
Summary
Fortinet details an AWS intrusion involving external use of a Jenkins instance role, privilege escalation, changes to database access controls, and Redshift data access. Investigators say the link to Shai Hulud is strongly supported but not proven.
Key points
- Investigators found evidence of access to a Jenkins runner and AWS activity in May 2026; they say a connection to prior Shai Hulud exposure is strongly supported but not definitively proven.
- The attacker retrieved Jenkins EC2 instance credentials through the instance metadata service and used the role from external IP addresses.
- The actor created an administrator IAM user, modified security groups and database cluster settings, and enumerated Secrets Manager for warehouse credentials.
- CloudTrail showed repeated Redshift Data API activity; the report says the volume supports data collection and exfiltration, while SQL details were redacted.
- FortiCNAPP correlated more than 1,300 CloudTrail events and raised alerts for compromised keys, external credential use, privilege escalation, and suspicious secrets enumeration.
- Defensive recommendations include treating CI/CD runners as tier-0 identities, restricting build-role privileges, alerting on external use of instance credentials, and monitoring database and security-group changes.
Article Details
- Attack Vectors
- Shai Hulud poisoned npm and PyPI packages execute during installation or CI jobs and harvest credentials from build environments.
- Stolen Jenkins instance-role credentials were used from external IP addresses to access AWS and escalate privileges.
- The operator created an administrator IAM user, modified security groups and database cluster access controls, enumerated secrets, and queried Redshift.
- The operator configured S3 policies and assumed roles with exfiltration-related session names; SSM SendCommand was also used on a managed EC2 instance.
- The article assesses a link between the Shai Hulud activity and the cloud compromise as strongly supported, but says there is no definitive proof that the worm infection caused it.
- Defensive Notes
- Treat CI/CD runners as tier-0 identities: use least-privilege instance profiles and avoid broad secrets or datastore access from build roles.
- Alert on instance credentials used from external IP addresses and unexpected outbound connections from build runners.
- Enforce change control and alerting for database-cluster modifications and security-group ingress changes.
- Monitor suspicious IAM policy names and STS role-session names, including exfil-related names.
- Investigate package and build-host activity alongside cloud identity and CloudTrail events.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]204[.]1[.]225 | External operator IP used for the first observed abuse of the Jenkins instance role. |
| IPV4 | 89[.]22[.]231[.]63 | Primary post-escalation operator IP; also observed in an outbound connection from the Jenkins host on port 8080. |
MITRE ATT&CK
T1078.004 · Cloud AccountsThe Jenkins EC2 instance role was used from external IP addresses.T1098 · Account ManipulationThe operator created the cloudops-monitor IAM user, attached AdministratorAccess, and issued access keys.T1195.002 · Compromise Software Supply ChainThe article maps prior Shai Hulud supply-chain exposure and suspected Jenkins persistence to this technique.T1496 · Resource HijackingThe article maps SES quota checks and identity verification staging to this technique.T1526 · Cloud Service DiscoveryThe article maps enumeration of cloud infrastructure and IAM to this technique.T1530 · Data from Cloud StorageThe operator issued repeated Redshift Data API queries against a production warehouse; the article assesses the activity as data collection and exfiltration.T1537 · Transfer Data to Cloud AccountThe operator attached S3 data-lake policies and used AssumeRole sessions named exfil-related values in activity assessed as exfiltration tradecraft.T1552.005 · Cloud Instance Metadata APIThe article reports IMDS access from the Jenkins runner to retrieve instance-role credentials.T1555 · Credentials from Password StoresThe operator enumerated Secrets Manager and retrieved targeted warehouse secrets.T1578 · Modify Cloud Compute InfrastructureThe operator modified security groups, staged EC2 instances, and attached security groups to database clusters.T1580 · Cloud Infrastructure DiscoveryThe operator enumerated AWS infrastructure, including S3, VPC, RDS, and Redshift resources.
Threat Actors
Malware
Vendors
Products
Amazon RedshiftThey showed that an operator had exploited the Jenkins role over the internet, escalated privileges to full cloud admin, changed database network controls, and extracted data from Amazon Redshift.AuroraInfrastructure manipulation: Attacker security groups, stage EC2 instances, and modify ModifyDBCluster or ModifyCluster to attach these groups to Aurora and Redshift.AWSAffected Platforms: Amazon Web Services (AWS)FortiClientThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiCNAPPIn May 2026, FortiCNAPP helped customers identify AWS estates affected by the worm.FortiEDRThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiGateThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiGuard AntivirusThe malware described in this report are detected and blocked by FortiGuard Antivirus as:FortiMailThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.
Tools
AWS CLIUser-agent strings in these calls form two groups (see Indicators): one linked to a Fedora/Qubes AWS CLI build from the first IP, and another associated with an Ubuntu 26 AWS CLI build that accounts for most of theBoto3Boto3/1.40.72 md/Botocore#1.40.72 ... os/linux#7.0.0-15-generic ...GitHub ActionsRecent variants have abused trusted OIDC publishing in GitHub Actions, producing artifacts that appear legitimately attested even though the runner itself was attacker-influenced.JenkinsBy mid-May, investigators found evidence of ongoing access to a Jenkins runner that matched Shai Hulud’s credential-harvesting pattern.