Loading story…
A human-operated intrusion exploited CVE-2026-39987, a pre-authentication remote-code-execution flaw in Marimo's terminal WebSocket endpoint, to obtain an interactive shell without credentials. The operator reportedly spent about four hours creating eight custom Python scripts and then conducted a nine-hour session with more than 850 interactive commands, using no identifiable public offensive tooling. Although the attacker viewed an LLM prompt-injection bait file, Sysdig's tripwire did not trigger, supporting the assessment that the operation was directed by a human rather than an autonomous AI agent.
The prepared chain harvested cloud credentials from the host environment and Redis, queried AWS Secrets Manager for an SSH private key, wrote the key to /tmp/bastion_key, and used it to access an internet-exposed bastion host within eight seconds. Additional scripts configured a Netcat relay on 45.79.187.72:4444 and attempted reverse-shell access; failed EC2 Instance Connect enumeration followed by SendSSHPublicKey for placeholder instance ID i-0000000000000000 created a distinctive automation fingerprint. Marimo releases through 0.20.4 are affected; version 0.23.0 remediates the vulnerability, which was also added to CISA's Known Exploited Vulnerabilities catalog.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Sysdig's Threat Research Team published a technical write-up documenting the CVE-2026-39987 exploitation activity, the custom toolkit, and the attempted AWS and SSH operations.
CVE-2026-39987 was listed in CISA's Known Exploited Vulnerabilities catalog. CISA set a federal remediation deadline of May 7, 2026, though the source does not state when the catalog addition occurred.
At approximately 18:56 UTC, background automation received denied responses for DescribeInstances, DescribeKeyPairs, and DescribeInstanceInformation, then submitted a blocked SendSSHPublicKey request for placeholder instance ID i-0000000000000000. Sysdig identified this denied-enumeration-to-placeholder sequence as a behavioral fingerprint of the operator's automation.
After compromising the Marimo host, the operator harvested credentials from the process environment and Redis backend, replayed them against AWS, and retrieved an SSH private key from AWS Secrets Manager. The prepared chain enabled access to an internet-reachable bastion host within eight seconds of launch.
A human operator exploited CVE-2026-39987, a pre-authentication RCE flaw in Marimo's terminal WebSocket endpoint, to obtain an interactive shell as the Marimo process user without credentials. The operator subsequently issued more than 850 interactive commands during a nine-hour session.
The operator spent roughly four hours developing and debugging eight custom Python scripts, then stored them on the compromised host for later execution. The scripts included AWS Secrets Manager retrieval, SSH-key handling, reverse-shell, and relay/listener automation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical pre-authentication remote code execution flaw in the Marimo open-source Python notebook platform was exploited in the wild less than 10 hours after disclosure, giving attackers an unauthenticated path to a full PTY shell through the `/terminal/ws` WebSocket endpoint. The vulnerability, tracked as `GHSA-2679-6mx9-h9xc` and later assigned `CVE-2026-39987`, affects Marimo versions `0.20.4` and earlier and carries a `CVSS 9.3` severity rating. Marimo addressed the issue in version `0.23.0`. Sysdig said it observed the first exploitation attempt against a honeypot 9 hours and 41 minutes after the advisory was published, despite the absence of a public proof-of-concept at the time. The attacker reportedly validated the flaw, obtained interactive shell access, searched the filesystem for `.env` files and SSH keys, and accessed fake AWS credentials planted on the system; Sysdig also recorded 125 additional unique IP addresses conducting reconnaissance in the first 12 hours. Researchers said the activity appeared to involve a human operator and warned defenders to patch immediately, restrict exposure to `/terminal/ws`, rotate potentially exposed secrets, and monitor for suspicious WebSocket connections.
Jun 29, 2026
Sysdig reported an intrusion in which a threat actor exploited **`CVE-2026-39987`** on an internet-exposed marimo notebook server and then used an **LLM agent** to carry out post-compromise actions. The attacker harvested AWS credentials, retrieved an SSH private key from **AWS Secrets Manager**, pivoted through a bastion host, and exfiltrated an internal **PostgreSQL** database in under an hour. Sysdig said the activity appeared agent-driven because commands were generated dynamically from live output, included machine-oriented formatting, and showed evidence of real-time adaptation rather than a fixed script. The operation also used distributed infrastructure, including **Cloudflare Workers**, to spread AWS API calls and SSH sessions across multiple source IPs, reducing the effectiveness of IP-based correlation. The incident adds to broader evidence that attackers are operationalizing language models in intrusions: Splunk previously analyzed **LAMEHUG**, a Windows malware family that uses a Hugging Face-hosted **Qwen 2.5-Coder-32B-Instruct** model to generate malicious commands for reconnaissance, file theft, and exfiltration over SSH or HTTPS. Defenders were urged to upgrade marimo to **0.23.0 or later**, restrict or disable the **`/terminal/ws`** endpoint if patching is not possible, rotate exposed credentials and keys, and prioritize behavior-based detection over static signatures.
Jun 29, 2026
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026