Evidence · DiggingBeagle record
Wiz incident reconstruction: Anatomy of a real AI-driven cloud attack
Wiz CIRT reconstructs a real cloud intrusion through an exposed Kafka UI, compromised cloud and IdP identities, and CI/CD or GitOps effects. The same IP scanned over 600 other environments, not 600 known breaches. The precise automation share and final exported data volume remain uncertain.
- Source role
- primary disclosure
Evidence record
Wiz CIRT reconstructs a real cloud intrusion through an exposed Kafka UI, compromised cloud and IdP identities, and CI/CD or GitOps effects. The same IP scanned over 600 other environments, not 600 known breaches. The precise automation share and final exported data volume remain uncertain.
Claim-level citations (5)
- supportsWiz reconstructs an AI-directed intrusion crossing cloud, identity and delivery systems: Wiz observed confirmed Java remote code execution through an exposed Kafka UI instance, followed by shell commands and a command-and-control channel.
Initial Access: Trying Every Door
- supportsWiz reconstructs an AI-directed intrusion crossing cloud, identity and delivery systems: The same originating IP scanned more than 600 other Wiz customer environments; Wiz did not report 600 additional successful intrusions.
Initial Access, final paragraph
- supportsWiz reconstructs an AI-directed intrusion crossing cloud, identity and delivery systems: Wiz reconstructed abuse of IdP administration, cloud tokens, AWS SSO access, GCP credentials and CI/CD or GitOps service accounts during the investigated intrusion.
Operating in Cloud Control Plane; Identity Provider; Weaponizing CI/CD and GitOps
- supportsWiz reconstructs an AI-directed intrusion crossing cloud, identity and delivery systems: Wiz reports that the attacker used a compromised GitOps deployment service account to change controller-managed workloads directly, including later mutations without corresponding malicious Git commits.
Weaponizing CI/CD and GitOps; Living Off Kubernetes, direct controller modification
- supportsWiz reconstructs an AI-directed intrusion crossing cloud, identity and delivery systems: Wiz reports transfers or staging through CI logs, source-control commits, Kubernetes ConfigMaps and an external request collector; not every attempted route establishes a measured volume of data loss.
Data Access and Exfiltration; CI/CD runners and attempted storage buckets