Security briefing: May 2026

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Attackers used vulnerable public services such as Canvas, marimo, PraisonAI, and Langflow to gain initial access (‘exploited a publicly exposed marimo notebook’; ‘authentication was disabled by default’; ‘unauthenticated RCE in Langflow’).
• [T1078 ] Valid Accounts – Stolen cloud credentials and keys were reused to access additional systems (‘stole two cloud credentials’; ‘using the credentials, a private key was identified, allowing SSH authentication’).
• [T1021.004 ] Remote Services: SSH – The attacker authenticated to an SSH bastion server using a recovered private key (‘allowing SSH authentication on an SSH bastion server’).
• [T1213 ] Data from Information Repositories – Sensitive data was pulled from internal systems and repositories (‘walked away with approximately 3,800 cloned repositories’; ‘the entire configuration of an internal PostgreSQL database was then exfiltrated’).
• [T1005 ] Data from Local System – Information such as files, tokens, passwords, and logs was exposed from a repository and administrative environment (‘credentials, files, tokens, passwords, logs, and more were all exposed’).
• [T1110 ] Brute Force – A scanner probed and validated the vulnerable PraisonAI endpoint shortly after disclosure (‘In less than four hours, a scanner was probing and validating the vulnerable endpoint’).
• [T1588.001 ] Obtain Capabilities: Malware – Attackers deployed malicious tooling including a backdoored extension and worker binaries (‘deployed a backdoored version of the Nx Console’; ‘downloaded a Python worker and a Go binary’).
• [T1105 ] Ingress Tool Transfer – Malicious payloads were downloaded to compromised systems (‘downloaded a Python worker and a Go binary over the course of 30 minutes’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – A basic repository safeguard was disabled, exposing secrets (‘disabled the default setting that would block publishing SSH keys and secrets to public repositories’).
• [T1027 ] Obfuscated Files or Information – The attacker used infrastructure and tactics intended to avoid malware-like detection (‘operating the same way modern cloud-native organizations do, and very intentionally not looking like malware’).
• [T1485 ] Data Destruction – Login portals were defaced as part of the extortion campaign (‘defaced the login portals of over 300 educational and corporate institutions’).