Latest Threats

linking threat corpus_

Agentic Threat Actor Container Escape — AI Agent-Driven marimo CVE-2026-39987 RCE → Docker Socket → Host Breakout (nsenter) → Kubernetes Secret Store Dump (Sysdig TRT) — Threadlinqs Intelligence

As of 2026-06-06, Agentic Threat Actor Container Escape — AI Agent-Driven marimo CVE-2026-39987 RCE → Docker Socket → Host Breakout (nsenter) → Kubernetes Secret Store Dump (Sysdig TRT) is a critical-severity cloud threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.

Threat ID: TL-2026-0694 · Severity: CRITICAL · CVSS: 9.3 · Status: ACTIVE · Category: CLOUD

On 2026-05-29 the Sysdig Threat Research Team observed an LLM-harness-driven (agentic) threat actor exploiting an unauthenticated marimo notebook terminal (CVE-2026-39987) and running a fully

This threat documents an agentic (AI-agent-driven) post-exploitation campaign observed by the Sysdig Threat Research Team (TRT) on 2026-05-29, materially escalating exploitation of marimo CVE-2026-39987 beyond prior human-operated intrusions (TL-2026-0619, TL-2026-0352). INITIAL ACCESS: The actor exploits CVE-2026-39987 (CVSS 9.3, CWE-306), a pre-authentication RCE in the marimo reactive Python notebook. The /terminal/ws WebSocket endpoint fails to call validate_auth() — unlike other endpoints — and directly invokes pty.fork() to spawn an interactive PTY shell to any unauthenticated client. Commands execute with the privileges of the marimo process, frequently root inside containerized deployments. The flaw was disclosed 2026-04-16, exploited in the wild within 9h41m of advisory publication, and is fixed in marimo 0.23.0. AGENTIC POST-EXPLOITATION: Rather than a human operator, an LLM harness drove the entire kill chain. Behavioral fingerprints establishing agentic operation include: disposable base64 canary payloads ('hello', then 'hello world') written to test the staging harness before real escapes; parseable section markers (===SHADOW===, ===SSH===, _SOCK_, _K8S_, _DOCKER_) emitted to slice output between agent turns; mechanical chunked base64 staging (base64 -d /tmp/r_.b64 > /tmp/r_.py); the agent acting on directives embedded in JSON error responses and shell escape sequences that only an automated parser would process; and adaptive fallback selection (switching to nsenter when bind-mount primitives failed). ENUMERATION: The agent issued systematic environment probes with output markers: container detection (test -f /.dockerenv), Docker socket presence (test -S /var/run/docker.sock), capability posture (grep CapEff /proc/1/status), seccomp posture (grep -i seccomp /proc/1/status), writable core_pattern (test -w /proc/sys/kernel/core_pattern), a kernel privilege-escalation reachability probe via python3 -c 'import socket;s=socket.socket(38,5,0)' (AF_VSOCK socket creation, 'Copy Fail' path), and Kubernetes projected service-account token presence (test -f /var/run/secrets/kubernetes.io/serviceaccount/token). CONTAINER ESCAPE: With a writable Docker socket, the agent POSTed to the Docker API over the unix socket (curl --unix-socket /var/run/docker.sock /containers/create) to launch privileged containers with Binds ['/:/host'], Privileged:true, PidMode:host, NetworkMode:host and IpcMode:host — granting full host filesystem and shared namespaces. It read /host/etc/shadow (password hashes) and the SSH private key /home/deploy/.ssh/id_ed25519, then swept for more keys (find /host -name id_rsa -o -name id_ed25519 -o -name '*.pem'). When bind-mounts were unavailable it fell back to nsenter --target 1 --mount --uts --net --pid -- sh -c 'cat /etc/shadow; cat /root/.ssh/authorized_keys', entering PID 1's namespaces directly. ORCHESTRATION-PLANE COMPROMISE: The agent read the projected Kubernetes service-account token and replayed it against the API server. A staged Python payload (delivered base64-chunked via /tmp/r_.b64) disabled TLS verification (ssl.CERT_NONE), set Authorization: Bearer <TOKEN>, queried /api/v1/namespaces/default/secrets, and dumped all Secret objects — exfiltrating keys including DATABASE_URL, DB_PASSWORD, openai-api-key and slack-webhook, e.g. postgresql://app:<redacted>@db.internal:5432/appdb. This is the orchestration-plane escalation that distinguishes this campaign from the AWS-pivot intrusion in TL-2026-0619. INFRASTRUCTURE: marimo exploitation originated from 103.43.71.95 (AS136209 KFNetworks, South Korea); second-stage payload delivery came from 43.167.11.88 (AS132203 Aceville Pte. Ltd./Tencent, Singapore), serving http://43.167.11.88:8084/slt. No specific named threat-actor group is attributed; staging across Korean and Singaporean infrastructure suggests Asia-Pacific operational staging. BeaconBeagle returned no known C2 beacon match for either IP at time of analysis.

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application; T1059.006 Command and Scripting Interpreter: Python; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204 User Execution; T1082 System Information Discovery; T1613 Container and Resource Discovery; T1526 Cloud Service Discovery; T1069 Permission Groups Discovery; T1611 Escape to Host; T1068 Exploitation for Privilege Escalation; T1610 Deploy Container; T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1552.001 Unsecured Credentials: Credentials In Files; T1552.007 Unsecured Credentials: Container API; T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow; T1528 Steal Application Access Token; T1021.004 Remote Services: SSH; T1213 Data from Information Repositories; T1105 Ingress Tool Transfer; T1132.001 Data Encoding: Standard Encoding

Associated CVEs

CVE-2026-39987

Weaknesses (CWE)

CWE-306, CWE-284, CWE-269

Target sectors: technology, saas, cloud-services, ai-ml, software-development

Target regions: Global, Asia-Pacific, North America

References

Related threats

Detections & IOCs

As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

CLOUD, CRITICAL, threat intelligence, cybersecurity, CVE-2026-39987, T1190, T1059.006, T1059.004, T1204, T1082, T1613, T1526, T1069, T1611, T1068

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison