Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
3 findings · run finished 2026-09-12 06:04Z · worst first
Trail KMS key disabled or scheduled for deletion3
InfoChanged
‹generated-workload-101› +6sandbox · us-west-2‹i-00000000000000065›167dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-101 in us-west-2 (account 345678901234): first seen 167 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/Dpozcecxtf · e/NPQRSTUVWXYZ e/VWXYZabcdefg e/cdefghijkmno +3
InfoChanged‹generated-workload-21› +3prod-acct · us-west-2‹i-00000000000000015›147dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-21 in us-west-2 (account 123456789012): first seen 147 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/DQKgLQfvca · e/NPQRSTUVWXYZ e/VWXYZabcdefg e/cdefghijkmno +4
InfoChanged‹generated-workload-61› +8234567890123 · us-west-2‹i-0000000000000003d›67dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-61 in us-west-2 (account 234567890123): first seen 67 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/BrNpNx68gA · e/NPQRSTUVWXYZ e/VWXYZabcdefg e/cdefghijkmno +8