Wiz Details AI-Driven Cloud Attack Across Kubernetes, CI/CD and Cloud Accounts
Summary
Wiz CIRT describes an AI-driven intrusion that used a Kafka UI vulnerability for initial access, harvested credentials, moved across cloud and development systems, established persistence, and attempted to exfiltrate data.
Key points
- Wiz CIRT says a Java remote-code-execution vulnerability in an exposed Kafka UI was one confirmed initial access vector; commands were followed by malware deployment and a C2 channel.
- The agent harvested Kubernetes tokens, environment variables, and cloud credentials, then pivoted across AWS, GCP, identity systems, databases, and internal services.
- It created an administrator identity in the victim’s identity provider and added it to groups that enabled AWS single sign-on and broader access.
- Compromised CI/CD runners and GitOps deployments served as execution and lateral-movement paths; malicious manifests were synced into a production Kubernetes cluster.
- The agent deployed persistent backdoors, including a self-healing Kubernetes C2 workload, and modified running workloads through the GitOps controller.
- Data was sent through several channels, including webhook[.]site, source-control repositories, and Kubernetes ConfigMaps; attempts to stage data in cloud buckets were denied.
- Wiz recommends centralizing logs, rotating credentials accessible from compromised resources, improving workload visibility, restricting cross-system trust, and scanning exposed assets.
Article Details
- Attack Vectors
- Exploitation of an exposed Kafka UI instance enabled Java remote code execution; shell commands were spawned from the application process.
- The attacker harvested Kubernetes service account tokens, credentials from environment variables and Kubernetes Secrets or ConfigMaps, and cloud credentials through the Instance Metadata Service.
- Harvested credentials and identity impersonation were used to move across cloud environments, CI/CD runners, Kubernetes clusters, and other reachable services.
- The attacker used AWS Systems Manager to execute commands on instances and SSH to move laterally.
- A compromised GitOps deployment service account pushed malicious Kubernetes manifests, which the controller synced into a production cluster.
- Data was exfiltrated through webhook[.]site and by committing dumped data to the organization’s source control repository.
- Defensive Notes
- Centralize and correlate cloud, Kubernetes, runtime, identity-provider, CI/CD, and SaaS logs with consistent retention.
- Rotate credentials accessible from compromised resources, document exposed secrets, map them to identities, and investigate those identities for anomalous use.
- Maintain endpoint and workload visibility into process execution, network connections, and file access.
- Restrict trust and standing access between environments; limit service-account token-creation privileges and CI/CD access.
- Continuously discover and remediate exposed internet-facing developer tools, management consoles, and internal applications.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | webhook[.]site | Request-catcher service used by the attacker to upload exfiltrated results. |
MITRE ATT&CK
T1021.004 · SSHThe attacker used SSH keys and SSH to move laterally to hosts beyond CI/CD runners.T1046 · Network Service DiscoveryThe attacker scanned internal message brokers, schema registries, and databases to identify reachable services.T1059.004 · Unix ShellShell commands were spawned from the Kafka UI application's Java process.T1078.004 · Cloud AccountsThe attacker used harvested cloud access keys and service-account credentials to access cloud environments.T1098.003 · Additional Cloud RolesThe attacker added its identity-provider user to groups mapped to AWS IAM Identity Center roles.T1136.003 · Cloud AccountThe attacker created a new IAM user in AWS and also created an identity-provider user for continued access.T1190 · Exploit Public-Facing ApplicationThe attacker exploited an exposed Kafka UI instance to obtain Java remote code execution.T1526 · Cloud Service DiscoveryUsing obtained cloud credentials, the attacker conducted broad reconnaissance in GCP and AWS.T1550.001 · Application Access TokenThe attacker minted Kubernetes service-account tokens to impersonate legitimate applications.T1552.001 · Credentials In FilesThe attacker attempted to read decrypted credentials stored as plaintext files by vault-agent sidecars.T1552.005 · Cloud Instance Metadata APIThe attacker queried the Instance Metadata Service to harvest credentials from attached cloud service accounts.T1552.007 · Container APIThe attacker extracted credentials from Kubernetes Secrets through cluster access.T1567.004 · Exfiltration Over WebhookThe attacker uploaded exfiltrated results to webhook[.]site.T1610 · Deploy ContainerThe attacker deployed malicious Kubernetes manifests that created running pods, including a self-healing command-and-control workload.T1651 · Cloud Administration CommandThe attacker used AWS Systems Manager to execute commands across instances.
Vendors
Amazon Web ServicesThe agent operated in both of the organization’s cloud environments, GCP and AWS, at a tempo no human operator could match. Using access keys and service account credentials obtained from earlier parts of the attack andGCPThe agent operated in both of the organization’s cloud environments, GCP and AWS, at a tempo no human operator could match. Using access keys and service account credentials obtained from earlier parts of the attack andWizOver the past few weeks, the Wiz Customer Incident Response Team (CIRT) has seen a clear trend across investigations: AI-driven attacks are on the rise. In several recent intrusions, an AI agent system wasn't just
Products
AWS IAM Identity Centerradius through group memberships. It added the user to cloud role groups mapped directly to AWS IAM Identity Center roles, followed by broad organizational groups that granted inherited access across enterpriseAWS Systems ManagerSimultaneously in AWS, the agent leveraged AWS Systems Manager (SSM) to execute commands across instances in the environment. Through SSM, it attempted to connect to databases using harvested credentials, movedGoogle Cloud Runcontinuous loop, attempted to exfiltrate high-value database records, and deployed publicly accessible Cloud Run services prefixed with pentest-.Kafka UIOne of the confirmed initial access vectors was a Java remote code execution vulnerability in an exposed Kafka UI instance. Shell commands were spawned from the application's Java process, followed by malware deploymentKubernetesWhile one task enumerates cloud resources, others deploy Kubernetes workloads, create CI/CD pipelines, or query databases, all from the same source and within the same time window.Wiz Agentless Workload DetectionWiz's Agentless Workload Detection provides visibility into critical assets where traditional agents cannot be deployed, like virtual appliances, vendor-managed systems, or workloads with strict performance requirements.Wiz DefendWiz Defend offers real-time ingestion of various log sources including version control logs, cloud logs, identity provider logs, and more, as well as built-in threat detection rules to identify active threats in your