Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
120 findings · run finished 2026-09-12 06:04Z · worst first
EC2 instance accepts IMDSv16
High
‹generated-workload-98› +3sandbox · eu-central-1‹i-00000000000000062›146d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-98 in eu-central-1 (account 345678901234): first seen 146 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/BSjCw2wbo5 · e/KLMNPQRSTUVW e/STUVWXYZabcd e/Zabcdefghijk +9
High‹generated-workload-18› +7prod-acct · eu-central-1 / payments-prod-cluster-2‹i-00000000000000012›126d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-18 in eu-central-1 (account 123456789012): first seen 126 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/7mD96YMg1v · e/KLMNPQRSTUVW e/STUVWXYZabcd e/Zabcdefghijk +1
High‹generated-workload-38› +6sandbox · eu-central-1‹i-00000000000000026›86d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-38 in eu-central-1 (account 345678901234): first seen 86 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/FrSNqE2JCa · e/fghijkmnopqr e/6789ABCDEFGH e/DEFGHJKLMNPQ +3
High‹generated-workload-88› +7234567890123 · eu-central-1‹i-00000000000000058›76d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-88 in eu-central-1 (account 234567890123): first seen 76 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/2dySnCctFp · e/9ABCDEFGHJKL e/GHJKLMNPQRST e/PQRSTUVWXYZa +8
High‹generated-workload-58› +5234567890123 · eu-central-1‹i-0000000000000003a›46d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-58 in eu-central-1 (account 234567890123): first seen 46 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/EsNA78d342 · e/KLMNPQRSTUVW e/STUVWXYZabcd e/Zabcdefghijk +5
High‹generated-workload-78› +4prod-acct · eu-central-1 / payments-prod-cluster-2‹i-0000000000000004e›6d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-78 in eu-central-1 (account 123456789012): first seen 6 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/DXc2x28NM4 · e/fghijkmnopqr e/6789ABCDEFGH e/DEFGHJKLMNPQ +7
EC2 instance accepts IMDSv13
Medium
‹generated-workload-68› +8sandbox · eu-central-1‹i-00000000000000044›116d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-68 in eu-central-1 (account 345678901234): first seen 116 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/PzHuBi8RGP · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +6
Medium‹generated-workload-108› +6prod-acct · eu-central-1 / payments-prod-cluster-0‹i-0000000000000006c›36d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-108 in eu-central-1 (account 123456789012): first seen 36 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/Hfz9XK3P2R · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +1
Medium‹generated-workload-28› +3234567890123 · eu-central-1‹i-0000000000000001c›16d•Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-28 in eu-central-1 (account 234567890123): first seen 16 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/5J86YzUpUa · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +2
Console login without MFA5
Medium
‹generated-workload-49› +3234567890123 · ap-southeast-1‹i-00000000000000031›163dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-49 in ap-southeast-1 (account 234567890123): first seen 163 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/5j1pTRrfKk · e/ABCDEFGHJKLM e/HJKLMNPQRSTU e/QRSTUVWXYZab +5
Medium‹generated-workload-39› +7prod-acct · ap-southeast-1‹i-00000000000000027›93dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-39 in ap-southeast-1 (account 123456789012): first seen 93 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/A2fuTxUG7u · e/ghijkmnopqrs e/789ABCDEFGHJ e/EFGHJKLMNPQR +4
Medium‹generated-workload-89› +8sandbox · ap-southeast-1‹i-00000000000000059›83dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-89 in ap-southeast-1 (account 345678901234): first seen 83 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/5nuZAvQeaE · e/ABCDEFGHJKLM e/HJKLMNPQRSTU e/QRSTUVWXYZab +9
Medium‹generated-workload-9› +5prod-acct · ap-southeast-1‹i-00000000000000009›63dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-9 in ap-southeast-1 (account 123456789012): first seen 63 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/4zt61QNTzM · e/ABCDEFGHJKLM e/HJKLMNPQRSTU e/QRSTUVWXYZab +1
Medium‹generated-workload-79› +5234567890123 · ap-southeast-1‹i-0000000000000004f›13dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-79 in ap-southeast-1 (account 234567890123): first seen 13 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/FJmKonjviW · e/ghijkmnopqrs e/789ABCDEFGHJ e/EFGHJKLMNPQR +8
Console login without MFA3
Low
‹generated-workload-99› +4prod-acct · ap-southeast-1‹i-00000000000000063›153dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-99 in ap-southeast-1 (account 123456789012): first seen 153 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/FQqkPQgVGk · e/LMNPQRSTUVWX e/TUVWXYZabcde e/abcdefghijkm +1
Low‹generated-workload-19› +8234567890123 · ap-southeast-1‹i-00000000000000013›133dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-19 in ap-southeast-1 (account 234567890123): first seen 133 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/62BKeBazBe · e/LMNPQRSTUVWX e/TUVWXYZabcde e/abcdefghijkm +2
Low‹generated-workload-59› +6sandbox · ap-southeast-1‹i-0000000000000003b›53dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-59 in ap-southeast-1 (account 345678901234): first seen 53 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/Ga5RWkJjqP · e/LMNPQRSTUVWX e/TUVWXYZabcde e/abcdefghijkm +6
Console login without MFA3
Info
‹generated-workload-69› +9prod-acct · ap-southeast-1‹i-00000000000000045›123dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-69 in ap-southeast-1 (account 123456789012): first seen 123 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/2s2ZhzYaPj · e/WXYZabcdefgh e/defghijkmnop e/456789ABCDEF +7
Info‹generated-workload-109› +7234567890123 · ap-southeast-1‹i-0000000000000006d›43dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-109 in ap-southeast-1 (account 234567890123): first seen 43 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/kQ474mDYyP · e/WXYZabcdefgh e/defghijkmnop e/456789ABCDEF +2
Info‹generated-workload-29› +4sandbox · ap-southeast-1‹i-0000000000000001d›23dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-29 in ap-southeast-1 (account 345678901234): first seen 23 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/BXCtmhEQyJ · e/WXYZabcdefgh e/defghijkmnop e/456789ABCDEF +3