Actor Claims 20 GB Cast AI Archive Contains Cloud Backups and GitLab Data
Summary
An actor using the handle “0xRune” claims a 20 GB Cast AI archive contains AWS and GCP infrastructure backups and GitLab data. The archive and its contents have not been independently verified.
Key points
- The listing attributes the claim to “0xRune” and advertises approximately 20 GB of Cast AI data.
- Claimed contents include AWS Lambda deployment packages, S3 backups, infrastructure-state data, and billing exports.
- The listing also claims a GitLab backup dated October 5, 2026, containing source code and multi-cloud infrastructure material.
- No underlying files, credentials, secrets, or source-code contents were visible in the supplied material.
- The archive’s authenticity, source, size, dates, and availability have not been independently verified.
Article Details
- Victim Organization
- Cast AI
- Incident Type
- Unverified data leak claim involving an alleged multi-cloud infrastructure and development-data archive
- Disclosure Date
- 2026-10-16
- Data Types Exposed
- Source code
- Infrastructure-state data and configurations
- AWS Lambda deployment packages
- S3 backups
- Billing exports
- Historical etcd snapshots
- PKI-related material
- Affected Data Size
- Approximately 20 GB claimed; not independently verified
- Operational Impact
- No operational impact or compromise has been independently confirmed. If authentic, the claimed archive could expose source code, infrastructure configurations, deployment packages, PKI-related material, historical cluster state, billing data, and multi-cloud operational details.
- Ransom Or Extortion
- The listing reportedly requires 1 point to unlock access. No ransom demand or extortion activity is reported.
- Claim Status
- claimed
MITRE ATT&CK
T1213.003 · Code RepositoriesThe article maps this as inferred collection from code repositories, based on the actor's claim that the archive includes a GitLab backup with source code and infrastructure code; the claim is unverified.T1530 · Data from Cloud StorageThe article maps this as inferred collection from cloud storage, based on the claim that the archive includes S3 backups and cloud infrastructure data; the claim is unverified.