Loading story…
Sysdig reported an intrusion in which a threat actor exploited CVE-2026-39987 on an internet-exposed marimo notebook server and then used an LLM agent to carry out post-compromise actions. The attacker harvested AWS credentials, retrieved an SSH private key from AWS Secrets Manager, pivoted through a bastion host, and exfiltrated an internal PostgreSQL database in under an hour. Sysdig said the activity appeared agent-driven because commands were generated dynamically from live output, included machine-oriented formatting, and showed evidence of real-time adaptation rather than a fixed script.
The operation also used distributed infrastructure, including Cloudflare Workers, to spread AWS API calls and SSH sessions across multiple source IPs, reducing the effectiveness of IP-based correlation. The incident adds to broader evidence that attackers are operationalizing language models in intrusions: Splunk previously analyzed LAMEHUG, a Windows malware family that uses a Hugging Face-hosted Qwen 2.5-Coder-32B-Instruct model to generate malicious commands for reconnaissance, file theft, and exfiltration over SSH or HTTPS. Defenders were urged to upgrade marimo to 0.23.0 or later, restrict or disable the /terminal/ws endpoint if patching is not possible, rotate exposed credentials and keys, and prioritize behavior-based detection over static signatures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Sysdig published research describing the May 10 intrusion as an AI-agent-driven post-exploitation chain, citing real-time improvisation, machine-oriented command formatting, and value handoffs between commands as evidence. It recommended upgrading marimo to version 0.23.0 or later, restricting or disabling the /terminal/ws endpoint if patching is not possible, and rotating exposed credentials and keys.
On May 10, 2026, an attacker exploited CVE-2026-39987 on an internet-exposed marimo notebook server, harvested AWS credentials, retrieved an SSH private key from AWS Secrets Manager, pivoted through a bastion host, and exfiltrated an internal PostgreSQL database. Sysdig said the intrusion completed in under an hour and used Cloudflare Workers IPs to distribute API calls and SSH activity across multiple source addresses.
CISA added Marimo CVE-2026-39987 to its Known Exploited Vulnerabilities catalog on April 23, 2026, reflecting active exploitation of the pre-authentication RCE flaw. The vulnerability affects Marimo versions before 0.23.0 and enables unauthenticated shell access via the /terminal/ws endpoint when edit mode is exposed.
Splunk Threat Research analyzed LAMEHUG's use of the Qwen 2.5-Coder-32B-Instruct model, its reconnaissance and file theft behavior, and its exfiltration methods over SSH or HTTPS. Splunk also released detections for WMIC discovery, service enumeration, file collection, and DNS queries to Hugging Face infrastructure.
CERT-UA identified LAMEHUG in July 2025 as a Windows malware family that uses a Hugging Face-hosted large language model to dynamically generate malicious commands during execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcedarkwebinformer.com
Open sourcecybersecuritynews.com
Open sourcewebflow.sysdig.com
Open sourcesysdig.com
Open sourcesplunk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026
Attackers began exploiting **CVE-2026-33626** in LMDeploy less than 13 hours after public disclosure, using a server-side request forgery flaw in vision-language request handling to make inference servers fetch attacker-controlled and internal URLs. Sysdig said the bug affects LMDeploy `0.12.0` and earlier with vision-language support, where `image_url` input is not properly restricted, and observed an eight-minute attack against its honeypot that probed AWS instance metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain. The activity included scans of loopback ports associated with **Redis**, **MySQL**, and HTTP services, underscoring the risk of exposing AI inference infrastructure to internal network discovery and cloud credential theft. The disclosures also highlighted broader weaknesses in LLM-serving platforms. LiteLLM published three advisories for LiteLLM Proxy that researchers said can be chained to achieve **remote code execution**, including an unauthenticated SQL injection (`GHSA-r75f-5x8p-qvmc`), a server-side template injection flaw, and an authenticated command-execution issue in MCP stdio test endpoints. The affected LiteLLM range is `1.81.16` through `1.83.6`, with fixes available in `1.83.7-stable` and later, while LMDeploy users were urged to upgrade to `v0.12.3+`, enforce **IMDSv2**, restrict egress, rotate IAM credentials, and monitor inference hosts for requests to metadata, loopback, and private-network addresses.
Jun 29, 2026
A critical pre-authentication remote code execution flaw in the Marimo open-source Python notebook platform was exploited in the wild less than 10 hours after disclosure, giving attackers an unauthenticated path to a full PTY shell through the `/terminal/ws` WebSocket endpoint. The vulnerability, tracked as `GHSA-2679-6mx9-h9xc` and later assigned `CVE-2026-39987`, affects Marimo versions `0.20.4` and earlier and carries a `CVSS 9.3` severity rating. Marimo addressed the issue in version `0.23.0`. Sysdig said it observed the first exploitation attempt against a honeypot 9 hours and 41 minutes after the advisory was published, despite the absence of a public proof-of-concept at the time. The attacker reportedly validated the flaw, obtained interactive shell access, searched the filesystem for `.env` files and SSH keys, and accessed fake AWS credentials planted on the system; Sysdig also recorded 125 additional unique IP addresses conducting reconnaissance in the first 12 hours. Researchers said the activity appeared to involve a human operator and warned defenders to patch immediately, restrict exposure to `/terminal/ws`, rotate potentially exposed secrets, and monitor for suspicious WebSocket connections.
Jun 29, 2026