Full Report
With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH
Analysis Summary
# Incident Report: Rapid Human-Operated Exploitation of Marimo RCE
## Executive Summary
A highly skilled human threat actor exploited a pre-authenticated Remote Code Execution (RCE) vulnerability in Marimo notebooks to breach a cloud environment. The attacker moved from initial access to an SSH bastion host in just eight seconds, demonstrating "machine-speed" execution without the use of AI agents. The incident resulted in the compromise of AWS credentials and unauthorized access to internal infrastructure.
## Incident Details
- **Discovery Date:** September 15, 2026 (Reported by Sysdig)
- **Incident Date:** September 2026
- **Affected Organization:** Not disclosed
- **Sector:** Technology / Cloud Computing
- **Geography:** Global (Targeting cloud infrastructure)
## Timeline of Events
### Initial Access
- **Date/Time:** 12:52 PM (Start of 9-hour session)
- **Vector:** Exploitation of CVE-2026-39987 (Marimo RCE)
- **Details:** The attacker established a WebSocket connection from `172.236.12[.]17` to the `/terminal/ws` endpoint exposed by a vulnerable Marimo notebook.
### Lateral Movement
- **18:57:22:** Fresh WebSocket connection initiated for the final pivot.
- **18:57:26:** Attacker executed a hand-rolled Python script to lookup stored credentials and harvest AWS keys.
- **18:57:30:** The attacker successfully authenticated to the SSH bastion host using a private key retrieved from AWS Secrets Manager.
### Data Exfiltration/Impact
- **Impact:** Full interactive shell access achieved.
- **Scope:** AWS Secrets Manager credentials compromised; private SSH keys stolen; unauthorized access to bastion host achieved.
### Detection & Response
- **How it was discovered:** Detected by Sysdig Threat Research Team through honeypot monitoring or telemetry analysis of the cloud environment.
- **Response actions taken:** Analysis of the threat actor's tradecraft, including the identification of 850 interactive commands and custom Python tooling.
## Attack Methodology
- **Initial Access:** Pre-authenticated RCE via Marimo notebook vulnerability (CVE-2026-39987).
- **Persistence:** Deployment of an `asyncssh`-style listener setup on an attacker-owned VPS.
- **Privilege Escalation:** Harvesting AWS credentials from the compromised application environment.
- **Defense Evasion:** Used hand-rolled, in-session scripts instead of recognizable offensive toolkits or AI agents to bypass automated detection and traps.
- **Credential Access:** Direct API calls to AWS Secrets Manager using harvested keys.
- **Discovery:** Manual reconnaissance during a 9-hour interactive session.
- **Lateral Movement:** Pivoting from the container/notebook environment to an SSH bastion host.
- **Collection:** Automated retrieval of SSH private keys.
- **Exfiltration:** Transfer of credentials and keys to an attacker-controlled VPS.
- **Impact:** Unauthorized administrative access to cloud infrastructure.
## Impact Assessment
- **Financial:** Potential for significant loss via cloud resource abuse or further data theft (unquantified).
- **Data Breach:** Compromise of sensitive cloud secrets and SSH private keys.
- **Operational:** Potential for total takeover of cloud-hosted services via the bastion host.
- **Reputational:** High risk due to the speed and sophistication of the breach.
## Indicators of Compromise
- **Network Indicators:**
- `172.236.12[.]17` (Attacker source IP)
- WebSocket connections to `/terminal/ws`
- **Behavioral Indicators:**
- Rapid sequence (8 seconds) of credential harvesting followed by SSH authentication.
- Execution of `python3` invocations performing network requests to AWS metadata or Secrets Manager endpoints.
- Use of `asyncssh` for reverse shell listeners.
## Response Actions
- **Containment measures:** Isolation of the compromised Marimo notebook instance.
- **Eradication steps:** Revocation of compromised AWS IAM credentials and rotation of all SSH keys stored in Secrets Manager.
- **Recovery actions:** Patching Marimo installations to versions not affected by CVE-2026-39987.
## Lessons Learned
- **Human Speed:** Skilled humans can match the speed of AI (8-second pivot), meaning defenders cannot assume "fast" attacks are always bot-driven.
- **Tooling Evasion:** Hand-rolled, in-session scripts are highly effective at evading EDR/XDR solutions that look for known offensive frameworks (e.g., Cobalt Strike, Metasploit).
- **AI Limitations:** AI agents often fall for "honeypot traps" that skilled humans successfully identify and bypass.
## Recommendations
- **Patch Management:** Immediately update Marimo notebooks to resolve CVE-2026-39987.
- **Identity & Access Management:** Implement "Least Privilege" for cloud instances; ensure notebook environments do not have direct permission to fetch sensitive keys from Secrets Manager unless strictly necessary.
- **Network Segmentation:** Restrict access to Marimo interfaces to internal VPNs rather than the public internet.
- **Monitoring:** Implement behavioral alerts for rapid credential access followed by lateral movement (SSH) from the same source.