Actor '0xRune' claims 20 GB Cast AI leak with AWS, GCP and GitLab backups
An actor using the handle 0xRune claims to have uploaded roughly 20 GB of data belonging to Cast AI, described as a multi-cloud, multi-region infrastructure backup and development environment. The listing references AWS Lambda deployment packages, S3 backups, infrastructure-state data, billing exports and a GitLab backup dated October 5, 2026. The actor says the GitLab material includes source code for AI agents, LLM routers, incident-management tooling and multi-cloud infrastructure code. The archive, its source, the 20 GB size and the claimed contents have not been independently verified, and the supplied screenshot shows no underlying files, credentials, secrets or source code.
Detalhes técnicos
- Claimed contents: AWS Lambda deployment packages across multiple regions, EC2 event handling references, local Kubernetes test-cluster material, infrastructure-state and test-cluster configurations, network add-on configuration, PKI security certificate material, historical etcd snapshots and billing exports in Parquet format.
- Claimed GitLab content: source code for AI agents, incident-management tooling, Terraform and GitOps content, GKE and AKS-related infrastructure code, and spot-instance and GPU-sharing optimization code.
- The listing describes a mixed infrastructure and development-data collection rather than a single database.
- Inferred ATT&CK mapping (not verified): T1213.003 (Code Repositories) and T1530 (Data from Cloud Storage).
- No malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled IP address is visible in the supplied material, and no initial access vector is stated.
- If authentic, the exposure could include source code, infrastructure mapping, secrets or credentials, PKI material, historical cluster state and billing data, creating risk of supply-chain abuse or follow-on compromise.
Remediação
The article gives no remediation guidance. As a precaution, defenders at Cast AI and its customers could review cloud and GitLab access logs, and rotate credentials, secrets and certificates if the claim is substantiated.
Linha do tempo
-
Actor '0xRune' claims 20 GB Cast AI leak with AWS, GCP and GitLab backups
ler a análise desta fonte ocultar
An actor using the handle 0xRune claims to have uploaded roughly 20 GB of data belonging to Cast AI, described as a multi-cloud, multi-region infrastructure backup and development environment. The listing references AWS Lambda deployment packages, S3 backups, infrastructure-state data, billing exports and a GitLab backup dated October 5, 2026. The actor says the GitLab material includes source code for AI agents, LLM routers, incident-management tooling and multi-cloud infrastructure code. The archive, its source, the 20 GB size and the claimed contents have not been independently verified, and the supplied screenshot shows no underlying files, credentials, secrets or source code.
Technical Details
- Claimed contents: AWS Lambda deployment packages across multiple regions, EC2 event handling references, local Kubernetes test-cluster material, infrastructure-state and test-cluster configurations, network add-on configuration, PKI security certificate material, historical etcd snapshots and billing exports in Parquet format.
- Claimed GitLab content: source code for AI agents, incident-management tooling, Terraform and GitOps content, GKE and AKS-related infrastructure code, and spot-instance and GPU-sharing optimization code.
- The listing describes a mixed infrastructure and development-data collection rather than a single database.
- Inferred ATT&CK mapping (not verified): T1213.003 (Code Repositories) and T1530 (Data from Cloud Storage).
- No malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled IP address is visible in the supplied material, and no initial access vector is stated.
- If authentic, the exposure could include source code, infrastructure mapping, secrets or credentials, PKI material, historical cluster state and billing data, creating risk of supply-chain abuse or follow-on compromise.
Remediation
The article gives no remediation guidance. As a precaution, defenders at Cast AI and its customers could review cloud and GitLab access logs, and rotate credentials, secrets and certificates if the claim is substantiated.