Back to cases

Live public case

Attempted exploitation

Last activity Aug 19, 10:41:50 AM PDT

highNot requiredResolved · Authorized test

Evidence-grounded assessment

Not required

The evidence establishes successful server-side command execution, not merely an attempt. Three captured HTTP responses contained non-reflected process-identity output identifying root/UID 0 despite HTTP 400 statuses ([redacted], [redacted], [redacted]). Event-driven telemetry in the correlated workload also recorded root dash shells and child discovery/sensitive-file processes ([redacted], [redacted], [redacted], [redacted]). HTTP requests with shell metacharacters and command tokens occurred in the same time windows ([redacted], [redacted]). The evidence does not provide a unique request-to-process trace edge, prove sensitive-file contents were returned, or prove an outbound connection.

Shared case lifecycle

Resolved · Authorized test

This read-only state comes from the same canonical workflow as the private operator console. Notes and append-only action history remain private.

Observed impact

  • Correlated process exited
  • Outbound client spawned
  • Sensitive file access command observed
  • Server identity disclosure
  • Shell spawned
  • Workload discovery process spawned
  • Workload root shell
  • Confirmed root-level server-side command execution and process-identity disclosure ([redacted]; [redacted]; [redacted]).
  • Root shell, identity-discovery, and sensitive-target cat processes executed in the workload ([redacted]; [redacted]; [redacted]; [redacted]).
  • An outbound-capable root shell process spawned, but no network connection is established by available flow evidence ([redacted]).

Recommended actions

    Attack timeline

    1 incident threads

    Resolution changes operator work, not the preserved attack evidence below.

    1. 1
      Attempted exploitationopen

      The evidence establishes successful server-side command execution, not merely an attempt. Three captured HTTP responses contained non-reflected process-identity output identifying root/UID 0 despite HTTP 400 statuses ([redacted], [redacted], [redacted]). Event-driven telemetry in the correlated workload also recorded root dash shells and child discovery/sensitive-file processes ([redacted], [redacted], [redacted], [redacted]). HTTP requests with shell metacharacters and command tokens occurred in the same time windows ([redacted], [redacted]). The evidence does not provide a unique request-to-process trace edge, prove sensitive-file contents were returned, or prove an outbound connection.