Sysdig Details KeyHunter Campaign Using NATS as C2 to Harvest Cloud and AI Credentials
Summary
Sysdig researchers traced KeyHunter activity exploiting Langflow CVE-2026-33017 to deploy credential-harvesting workers, validate AWS and AI keys, and use an ACL-enforced NATS server for C2; the operator also attempted container escape.
Key points
- Sysdig reports that the operator exploited unauthenticated Langflow RCE vulnerability CVE-2026-33017 to access a target and extract AWS credentials from its environment.
- The KeyHunter worker was designed to scan code-sandbox platforms and web URLs for credentials, then validate AWS and AI-provider keys.
- Captured activity showed a NATS server used as C2; its ACLs restricted worker publishing to result and heartbeat subjects.
- Sysdig observed an accepted AWS identity check and subsequent reconnaissance requests involving services including Bedrock, S3, EC2, Lambda, and IAM.
- The operator attempted container escape using DirtyPipe and DirtyCreds, but the Go payload panicked; the Python worker remained the active path.
- Static analysis identified platform-specific scraping methods, gitleaks integration, and a systemd service configured to keep the worker running.
- Sysdig recommends patching Langflow, restricting outbound traffic, and rotating credentials that may have been accessible to exposed instances.
Article Details
- Attack Vectors
- The operator exploited unauthenticated RCE in Langflow via CVE-2026-33017 to dump process environment variables containing AWS credentials.
- A Python worker scanned CodePen, JSFiddle, StackBlitz, CodeSandbox, and arbitrary URLs for credentials, then validated harvested AWS and AI API keys.
- The operator used NATS at 45.192.109.25:14222 as an ACL-enforced coordination channel for worker tasks, heartbeats, and results.
- The operator used valid harvested AWS credentials for reconnaissance across cloud services and attempted Bedrock model invocation.
- The operator attempted to escape the container using DirtyPipe and DirtyCreds exploits; the Go payload panicked, while the Python worker remained operational.
- The deployment script installed a systemd service configured to restart the worker automatically.
- Defensive Notes
- Update Langflow to a version that patches CVE-2026-33017.
- Block outbound traffic to 45.192.109.25:14222 and 159.89.205.184:8888.
- Restrict outbound traffic from AI tooling and visual-flow platforms to required endpoints.
- Rotate AWS, OpenAI, Anthropic, or HuggingFace credentials that may have been accessible from an exposed Langflow instance.
- Use Sysdig Secure or OSS Falco rules to detect suspicious system service modification and outbound connections to C2 servers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 159[.]89[.]205[.]184 | Operator activity source and staging host used to serve worker files; the staging HTTP service used port 8888. |
| IPV4 | 45[.]192[.]109[.]25 | NATS C2 server used to coordinate the credential-harvesting worker; the observed endpoint used port 14222. |
| SHA256 | 16b279aa018c64294d58280636e538f86e3dd9bdcb5734c203373394b72d101a | SHA-256 hash of deploy.sh, the installer used to install and persist the worker. |
| SHA256 | 323bbf3064d4b83df7920d752636b1acb36f462e58609a815bd8084d1e6b004c | SHA-256 hash of the staged keyhunter_worker.py credential-harvesting worker. |
| SHA256 | dbee863ad2a39f939be2c7ed76f7d5a8fe000aad2d2b2d32b3e8ec3ee42f1c25 | SHA-256 hash of the staged worker-linux-amd64 Go binary. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe worker was configured to report captured credentials and scan results to the operator through the NATS coordination channel.T1059.006 · PythonThe operator used a Python worker and an ad-hoc Python script to harvest credentials and test NATS ACL permissions.T1078.004 · Cloud AccountsThe operator used harvested AWS credentials that were accepted by sts:GetCallerIdentity to make subsequent AWS API calls.T1105 · Ingress Tool TransferThe operator downloaded a Python worker and a Go binary from the staging server at 159.89.205.184:8888.T1190 · Exploit Public-Facing ApplicationThe operator obtained initial access by exploiting unauthenticated RCE in the internet-facing Langflow target via CVE-2026-33017.T1526 · Cloud Service DiscoveryUsing the harvested AWS credentials, the operator enumerated services and resources including S3 buckets, EC2 instances, Lambda functions, ECS clusters, and IAM policies.T1543.002 · Systemd ServiceThe deploy script installed a keyhunter-worker.service systemd unit configured to restart the worker automatically.T1552.001 · Credentials In FilesThe exploit payload dumped the Langflow process environment and extracted AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.T1611 · Escape to HostThe operator attempted to escape the container using DirtyPipe and DirtyCreds exploits; the Go payload panicked during the attempt.
CVE
Malware
Vendors
Amazon Web ServicesThe operation also attempted container escape with DirtyPipe and DirtyCreds, validated stolen AWS keys, and targeted cloud and AI credentials from code-sandbox platforms.AnthropicThis is the same monetization pathway as the worker’s validate_ai capability, just applied to AWS-native LLM inference rather than OpenAI or Anthropic SaaS keys.HuggingFaceRotate any AWS, OpenAI, Anthropic, or HuggingFace credentials that were reachable from a Langflow instance exposed prior to patching.OpenAIThis is the same monetization pathway as the worker’s validate_ai capability, just applied to AWS-native LLM inference rather than OpenAI or Anthropic SaaS keys.
Products
Amazon BedrockThe broader campaign included AWS reconnaissance and attempts to use stolen credentials against services such as Bedrock, S3, EC2, Lambda, ECS, and IAM.CodePenscan_cde targets Cloud Development Environment platforms (CodePen, JSFiddle, StackBlitz, CodeSandbox), with a GenericClient fallback for any URL the queue dispatches.CodeSandboxscan_cde targets Cloud Development Environment platforms (CodePen, JSFiddle, StackBlitz, CodeSandbox), with a GenericClient fallback for any URL the queue dispatches.JSFiddlescan_cde targets Cloud Development Environment platforms (CodePen, JSFiddle, StackBlitz, CodeSandbox), with a GenericClient fallback for any URL the queue dispatches.LangflowSysdig TRT discovered “NATS-as-C2,” a novel command-and-control approach where the KeyHunter operator used a NATS server to coordinate a credential-harvesting worker after exploiting CVE-2026-33017 in Langflow.LiteLLMSSRF exploit events against LMDeploy, plus master-key and admin-surface probing on a LiteLLM instanceLMDeployFirst probes against an LMDeploy (LLM inference service) instance: Swagger root, /v1/models enumeration, SSRF against the multimodal endpoint NATSSysdig TRT discovered “NATS-as-C2,” a novel command-and-control approach where the KeyHunter operator used a NATS server to coordinate a credential-harvesting worker after exploiting CVE-2026-33017 in Langflow.StackBlitzscan_cde targets Cloud Development Environment platforms (CodePen, JSFiddle, StackBlitz, CodeSandbox), with a GenericClient fallback for any URL the queue dispatches.