Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – The attacker gained initial access by abusing marimo’s unauthenticated terminal WebSocket endpoint. [‘exploited CVE-2026-39987, a pre-authentication remote code execution (RCE) vulnerability in marimo’ and ‘Any client that can open a WebSocket to that path is granted a full interactive shell’]
• [T1059.006 ] Command and Scripting Interpreter: Python – The operator wrote and ran custom Python scripts for AWS access, key handling, and pivoting. [‘they wrote a Python toolkit they wrote and debugged by hand’ and ‘boto3 chain script’]
• [T1003 ] OS Credential Dumping – The attacker harvested AWS credentials from the compromised host’s environment and Redis-backed application data. [‘Credential 1 was harvested from environment variables and credential files’ and ‘Credential 2 was returned by the application’s Redis backend’]
• [T1528 ] Steal Application Access Token – The operator reused harvested cloud credentials to access AWS Secrets Manager and pivot further into the environment. [‘using credentials harvested from the compromised instance’ and ‘replayed against the internet-reachable bastion host’]
• [T1552.001 ] Unsecured Credentials: Credentials In Files – Credentials and the resulting SSH key were handled from files on disk such as /tmp/bastion_key. [‘wrote the retrieved key to /tmp/bastion_key’ and ‘Hunt for chain.py, bastion_key’]
• [T1082 ] System Information Discovery – The attacker enumerated EC2 resources to identify targets and determine instance IDs. [‘DescribeInstances’, ‘DescribeKeyPairs’, ‘DescribeInstanceInformation’ and ‘enumerate running instances to get an instance ID’]
• [T1021.004 ] Remote Services: SSH – The operator authenticated to a bastion host over SSH using the retrieved private key. [‘SSH access to a bastion host with the retrieved private key’ and ‘SSH authentication observed at the bastion host’]
• [T1105 ] Ingress Tool Transfer – The attacker dropped base64-encoded Python tooling into /tmp/ for later execution. [‘echo ” | base64 -d > /tmp/.py’ and ‘the toolkit is reproduced below, in deployment order’]
• [T1041 ] Exfiltration Over C2 Channel – The operator set up a reverse-shell listener and callback infrastructure on an attacker-owned VPS. [‘starts a new nohup nc -lvp 4444 listener’ and ‘callback sink’]
• [T1578 ] Modify Cloud Compute Infrastructure – The EC2 Instance Connect path attempted to push an SSH public key directly to a target instance. [‘ec2:SendSSHPublicKey fired’ and ‘use EC2 Instance Connect to push an operator-controlled public key’]