/
← Voltar ao feed
medium exploit público gambling ai_platforms technology

Chinese-speaking actor abuses Flowise honeypot to harvest secrets and use its LLM agent for recon against a gambling network's Nightingale server

2 fonte(s) · 2 atualização(ões) · publicado 14/10/2026 08:29 · coletado há 16 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 23/10/2026 00:03; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ sekoia.com ↗

In late August 2026, Sekoia TDR observed an attacker interact with an unauthenticated Flowise honeypot emulating v2.2.8. The attacker enumerated chatflows and stored credentials, created a rogue "System Status" chatflow with a callback to attacker infrastructure (154.217.251[.]226), and used prompt injection to turn the LLM agent into an offensive analysis assistant (sekoia.com). The prompts, in Chinese and English, targeted a real Nightingale (N9E) monitoring server with an exposed Redis instance. Sekoia assesses with high confidence that the server belongs to an unregulated online gambling platform (98br/playz-prod), focused on its Hong Kong and Taiwan segments (sekoia.com). The actor is assessed as a likely native Chinese speaker acting for cybercriminal, opportunistic purposes, with no attribution to a known group. Earth Berberoka and Operation Dragon Castling are cited only as sector context (sekoia.com, gbhackers.com). The honeypot ran no real model or system code, so the findings do not show that secrets were stolen from any production deployment (gbhackers.com). Sekoia first shared the findings in a private FLINT report on 7 September 2026, and its public write-up came on 14 October 2026 (gbhackers.com, sekoia.com).

Entenda a falha

A vulnerabilidade

The story names three Flowise CVEs, but the activity it describes mostly abused legitimate functionality of an unauthenticated instance. CVE-2025-59528 is a remote code execution flaw in the CustomMCP node, and CVE-2026-41264 is a remote code execution flaw in the CSV Agent node. Sekoia says its honeypot only monitors them and that exploitation was not observed. The articles give no affected or fixed versions for either. CVE-2024-31621 is an authentication bypass that exposes workflow and credential APIs, fixed in Flowise 1.6.6. The behavior resembled it, but Sekoia did not demonstrate its exploitation. The honeypot only emulated Flowise 2.2.8.

Como funciona

In the observed activity, the attacker fingerprinted the service and its version, then listed chatflows and stored credentials and requested individual credential records looking for API keys and database details. After about two hours, they probed more APIs, tried to rename a chatflow and created a "System Status" chatflow with an HTTP Request node pointing at attacker infrastructure, which would send an outbound callback if run. They also used prompt injection to make the LLM agent query a simulated finance RAG database and give advice on a real Nightingale server. No code execution or persistence was proven. The articles do not describe the internal steps of the two RCE flaws.

Por que é vulnerável

For the RCE flaws, Sekoia describes the causes as unsafe evaluation of user-supplied configurations in the CustomMCP node and unsandboxed code execution in agent nodes such as the CSV Agent. For the authentication bypass and credential disclosure class, the issue is administrative and credential APIs reachable without authentication. The observed activity was made possible by exposing Flowise without authentication. Flowise holds model-provider keys, connects to private data stores and gives agents tools, so an exposed or overprivileged instance leads to credential exposure and misuse. Prompt injection against agents with network or database permissions can become misuse of that access.

Onde está

The articles name the CustomMCP node (CVE-2025-59528) and the CSV Agent node (CVE-2026-41264); the observed activity touched the /api/v1/chatflows and /api/v1/credentials endpoints. No file, function or fixing commit is named.

Como foi descoberta

The Sekoia TDR team saw the activity in late August 2026 on its own unauthenticated Flowise honeypot, which uses simulated responses and canary credentials and runs no real model or system code. Sekoia shared the findings in a private FLINT report on 7 September 2026 and published the write-up on 14 October 2026. The CVEs were already known and are monitored by the honeypot. gbhackers.com says the article mentions exploitation attempts against them, but Sekoia says none were observed. Sekoia assesses the actor as a likely Chinese speaker, opportunistic and cybercriminal, with no attribution to a named group.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:18.

2 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2025-59528, CVE-2024-31621. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52440 ↗ · aplicação web · multiple · pub. 31/10/2025 não verificado

    Flowise 3.0.4 - Remote Code Execution (RCE)

    The script targets Flowise versions before 3.0.5 and abuses the feature that loads settings for a custom MCP server node. The configuration text is evaluated as JavaScript instead of being treated as data. The attacker needs network access to the Flowise instance and a valid account, because the script logs in first. It runs an operating system command with the privileges of the Flowise server process, which means full remote code execution. It is a short, working-style exploit, though Exploit-DB has not verified it.

    CVE-2025-59528 · autor: nltt0 · explicação gerada por IA
  2. exploit-db.com · EDB-52001 ↗ · aplicação web · typescript · pub. 21/04/2024 não verificado

    Flowise 1.6.5 - Authentication Bypass

    Flowise 1.6.5 and earlier has an authentication bypass in the middleware that protects the REST API. The check only matches the lowercase form of the API path prefix, so a request with different letter casing skips authentication and still reaches the handler. The attacker needs only network access to the server, no credentials or user interaction, and can read protected data such as stored credentials. This is a short write-up with a one-line proof of concept rather than a full tool, but it genuinely matches the CVE.

    CVE-2024-31621 · autor: Maerifat Majeed · explicação gerada por IA

Detalhes técnicos

  • The activity mostly abused legitimate Flowise functionality rather than exploiting CVEs (sekoia.com). It ran in six phases (sekoia.com):
    • P1: discovery and exfiltration, about 3 minutes.
    • P2: inactivity, about 2 hours.
    • P3: in-depth reconnaissance and inference probing.
    • P4: chatflow manipulation.
    • P5: LLM abuse.
    • P6: polling of global variables and chatflows every 10 minutes.
  • Fingerprinting used /api/v1/ping, /api/v1/version and /api/v1/node-configs. The attacker then enumerated /api/v1/chatflows and /api/v1/credentials and fetched individual secrets via /credentials/{uuid}, seeking OpenAI/Anthropic keys and database details. A later sweep covered components, nodes, tools, document-store, vector-store, apikey, users, variables and more (sekoia.com).
  • Verb fuzzing (PUT/PATCH/POST) was used to rename a chatflow to "Customer Support v2". The attacker then created the "System Status" chatflow with an HTTP Request node calling http://154.217.251[.]226:19999/flowise-hb, a beacon/heartbeat to attacker infrastructure (sekoia.com). No code execution or persistence was proven (gbhackers.com).
  • Prompt injection used fake "authorized audit" jailbreaks to query the RAG-connected finance database, port-scan requests against the decoy PostgreSQL host, and attempts to expose system prompts and conversation history. The attacker also asked for known unauthenticated vulnerabilities, default credentials and API exploitation paths for Nightingale v6, supplying real Redis keys such as n9e_meta_zl-hk-playz-prod-bizsys-gitlab-001 (sekoia.com, gbhackers.com). Public internet-search data showed the exposed Nightingale interface, Redis service and keys (gbhackers.com).
  • The Redis keys reveal infrastructure in Hong Kong, South Korea, Singapore, Brazil, Japan and Taiwan (AWS, Zenlayer, JumpServer, ZenTao). The attacker searched only for weaknesses in the Hong Kong and Taiwan environments. Linked domains are 98br[.]org and 98br[.]game; the APK references gr99[.]top and 11kk[.]co (sekoia.com).
  • The source IP used a minimal Mozilla/5.0 User-Agent. No similar activity was seen on other Sekoia Flowise honeypots in the prior 30 days (sekoia.com).
  • The behavior resembled an authentication bypass, but Sekoia did not demonstrate exploitation of CVE-2024-31621 (fixed in Flowise 1.6.6); it is cited only as a comparison (gbhackers.com, sekoia.com).

Remediação

  • Never expose Flowise without strong authentication, and enforce strict permission boundaries (sekoia.com).
  • Monitor outbound network connections for unexpected callbacks (sekoia.com).
  • Inventory exposed Flowise deployments, restrict access to administrative and credential APIs, and update to versions fixing applicable vulnerabilities (gbhackers.com).
  • Keep secrets out of workflows accessible to untrusted users (gbhackers.com).
  • Limit agent tools and outbound access to what each workflow needs, and make RAG permissions mirror the underlying data access boundaries (gbhackers.com).
  • Log workflow changes, credential access, unusual inference requests and unexpected outbound connections (gbhackers.com).
  • Treat agents as privileged applications with least privilege. Prompt-injection testing complements but does not replace access controls (gbhackers.com).

Relatos divergentes

  • CVE exploitation: gbhackers.com says the article mentions exploitation attempts against known Flowise flaws, including CVE-2025-59528 (CustomMCP RCE) and CVE-2026-41264 (CSV Agent RCE). Sekoia (sekoia.com), the original and more authoritative source, says the honeypot only monitors these CVEs and that exploitation was not observed. Sekoia's account should be preferred.
  • Secret theft: sekoia.com describes the attacker as harvesting stored credentials, while gbhackers.com stresses the honeypot held no real secrets, so no production theft is shown.
  • Rogue chatflow: sekoia.com says the attacker tried to plant a malicious chatflow, while gbhackers.com says only that the chatflow could have triggered an outbound callback and that no code execution was proven.

Linha do tempo

  1. gbhackers.com ↗ · pub. 22/10/2026 06:26 · coletado 22/10 08:00

    Opportunistic attacker probes Flowise honeypot for credentials, hijacks workflows and uses LLM prompts for iGaming recon

    ler a análise desta fonte

    Sekoia observed an attacker interacting with an exposed Flowise AI orchestration honeypot (emulating version 2.2.8) in late August 2026. The operator enumerated chatflows and stored credentials, tried to create a rogue workflow, and used prompt injection to turn the agent into an offensive analysis assistant. Sekoia assesses the activity as opportunistic cybercrime by a likely fluent Chinese speaker familiar with offshore iGaming infrastructure, and does not attribute it to a named APT group. Because the honeypot ran no real model or system code, the findings do not show that secrets were stolen from any production deployment.

    Technical Details

    • The attacker first checked the service and version, then queried APIs listing chatflows and credentials, and requested individual credential records seeking API keys and database connection details.
    • The behavior resembled an authentication bypass, but Sekoia states it did not demonstrate exploitation of CVE-2024-31621 (fixed in Flowise 1.6.6); the CVE was cited only as a comparison.
    • After a pause of about two hours, the operator probed more APIs, tested inference routes, tried to rename an existing workflow and created a "System Status" chatflow with an HTTP Request node pointing at attacker infrastructure, which could have triggered an outbound callback. No code execution or persistence was proven.
    • Prompts attempted to override instructions, expose system prompts and conversation history, probe tools and query a simulated finance RAG workflow.
    • The operator supplied Nightingale monitoring-system details and Redis key names tied to a real online-gambling environment, requesting targeted analysis in Chinese, apparently seeking vulnerability and lateral-movement guidance. Sekoia reports that public internet-search data showed the exposed Nightingale interface, Redis service and keys.
    • The article also mentions exploitation attempts targeting known Flowise flaws, including the CustomMCP RCE (CVE-2025-59528) and the CSV Agent RCE (CVE-2026-41264).
    • The findings were first shared in a private FLINT report on 7 September 2026.

    Remediation

    • Inventory exposed Flowise deployments, restrict access to administrative and credential APIs, and update to versions fixing applicable vulnerabilities.
    • Avoid placing secrets in workflows accessible to untrusted users.
    • Limit agent tools and outbound network access to what each workflow needs, and make RAG permissions mirror the underlying data access boundaries.
    • Log workflow changes, credential access, unusual inference requests and unexpected outbound connections.
    • Treat agents as privileged applications with least privilege; prompt-injection testing complements but does not replace access controls.
  2. sekoia.com ↗ · pub. 14/10/2026 08:29 · coletado 20/10 16:30 primeiro registro

    Chinese-speaking actor abuses unauthenticated Flowise honeypot to steal secrets and use its LLM agent against a gambling network's Nightingale server

    ler a análise desta fonte

    In late August 2026, Sekoia's TDR team observed an attacker compromise an unauthenticated Flowise honeypot (emulating v2.2.8). The attacker harvested stored credentials, tried to plant a malicious chatflow with a callback to 154.217.251[.]226, and used prompt injection to turn the LLM agent into an offensive analysis assistant. The activity mostly abused legitimate Flowise functionality rather than exploiting CVEs. Prompts written in Chinese and English targeted a real Nightingale (N9E) monitoring server with an exposed Redis instance. Sekoia assesses with high confidence that this server belongs to the infrastructure of an unregulated online gambling platform (98br/playz-prod), with a focus on its Hong Kong and Taiwan segments. The actor is assessed as a likely native Chinese speaker acting for cybercriminal purposes. No attribution to a known group is possible; Earth Berberoka and Operation Dragon Castling are cited only as sector context.

    Technical Details

    • Six phases: P1 discovery and exfiltration (~3 min), P2 inactivity (~2 h), P3 in-depth reconnaissance and inference probing, P4 chatflow manipulation, P5 LLM abuse, P6 polling every 10 minutes of global variables and chatflows.
    • Fingerprinting via /api/v1/ping, /api/v1/version and /api/v1/node-configs. Enumeration of /api/v1/chatflows and /api/v1/credentials, then retrieval of individual secrets via /credentials/{uuid} (OpenAI/Anthropic keys, database details). A later sweep covered components, nodes, tools, document-store, vector-store, apikey, users, variables and more.
    • Verb fuzzing (PUT/PATCH/POST) to rename a chatflow to "Customer Support v2". The attacker then created a chatflow named "System Status" with an HTTP Request node calling http://154.217.251[.]226:19999/flowise-hb, a beacon/heartbeat to attacker infrastructure.
    • Prompt injection: fake "authorized audit" jailbreaks to query the RAG-connected finance database, port-scan requests against the decoy PostgreSQL host, and prompts asking for known unauthenticated vulnerabilities, default credentials and API exploitation paths for Nightingale v6, using real Redis keys (e.g. n9e_meta_zl-hk-playz-prod-bizsys-gitlab-001).
    • Redis keys reveal infrastructure across Hong Kong, South Korea, Singapore, Brazil, Japan and Taiwan (AWS, Zenlayer, JumpServer, ZenTao). The attacker searched only for weaknesses in the Hong Kong and Taiwan environments. Linked domains: 98br[.]org, 98br[.]game; the APK references gr99[.]top and 11kk[.]co.
    • The honeypot monitors CVE-2025-59528 (CustomMCP RCE), CVE-2026-41264 (CSV Agent RCE) and flaws similar to CVE-2024-31621 (auth bypass/credential disclosure). Exploitation of these was not observed. The source IP used a minimal Mozilla/5.0 User-Agent, and no similar activity was seen on other Sekoia Flowise honeypots in 30 days.

    Remediation

    • Never expose Flowise without strong authentication; enforce strict permission boundaries.
    • Monitor outbound network connections from orchestration platforms and restrict HTTP Request node destinations.
    • Apply guardrails against prompt injection and agent abuse, and rotate any secrets stored on exposed instances.
    • Patch Flowise against the cited CVEs.