Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
6 findings · run finished 2026-09-12 06:04Z · worst first
Trail KMS key disabled or scheduled for deletion6
MediumChanged
‹generated-workload-71› +4sandbox · us-west-2‹i-00000000000000047›137dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-71 in us-west-2 (account 345678901234): first seen 137 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/HEvE2Er7r8 · e/YZabcdefghij e/fghijkmnopqr e/6789ABCDEFGH +9
MediumChanged‹generated-workload-41› +9sandbox · us-west-2‹i-00000000000000029›107dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-41 in us-west-2 (account 345678901234): first seen 107 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/Hs3wrok7Jh · e/23456789ABCD e/9ABCDEFGHJKL e/GHJKLMNPQRST +6
MediumChanged‹generated-workload-111› +9prod-acct · us-west-2‹i-0000000000000006f›57dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-111 in us-west-2 (account 123456789012): first seen 57 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/6LzBR2nYDk · e/YZabcdefghij e/fghijkmnopqr e/6789ABCDEFGH +4
MediumChanged‹generated-workload-31› +6234567890123 · us-west-2‹i-0000000000000001f›37dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-31 in us-west-2 (account 234567890123): first seen 37 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/2yuhos65Lw · e/YZabcdefghij e/fghijkmnopqr e/6789ABCDEFGH +5
MediumChanged‹generated-workload-81› +7prod-acct · us-west-2‹i-00000000000000051›27dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-81 in us-west-2 (account 123456789012): first seen 27 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/DB71Lsa9gz · e/23456789ABCD e/9ABCDEFGHJKL e/GHJKLMNPQRST +1
MediumChanged‹generated-workload-1› +4234567890123 · us-west-2‹i-00000000000000001›7dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-1 in us-west-2 (account 234567890123): first seen 7 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/2y2apsmrLL · e/23456789ABCD e/9ABCDEFGHJKL e/GHJKLMNPQRST +2