Multi-Platform Data Exfiltration Across AWS and GitHub via Stolen GitHub Token and Hardcoded AWS Credentials (Wiz Blue Agent Investigation)

Key facts

Detection coverage

As of 2026-09-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2772 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AWS API Calls From Offensive-Tool User-Agent (aws-cli on Kali Linux)

Detects AWS CloudTrail activity whose user-agent carries a Kali/Parrot/Pentoo/Pacu marker. In this intrusion the compromised svc_automation AKIA key was driven from aws-cli on Kali Linux (kali-amd64), a sharp break from its TeamCity Server / aws-sdk-go baseline. Flags sensitive follow-on APIs (AssumeRole, GetSessionToken, RunInstances, SendCommand) seen in the same identity.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078.004
• Data sources: aws:cloudtrail, AWSCloudTrail
• Severity: high
• Confidence: high

Splunk SPL

```AWS API calls from offensive-tool OS user-agents (aws-cli on Kali)```
index=aws sourcetype="aws:cloudtrail" earliest=-24h
  (userAgent="*kali*" OR userAgent="*parrot*" OR userAgent="*pentoo*" OR userAgent="*pacu*")
| eval actor=coalesce('userIdentity.userName', 'userIdentity.sessionContext.sessionIssuer.userName', 'userIdentity.arn'), id_type='userIdentity.type', key_id='userIdentity.accessKeyId'
| stats count as api_calls, dc(eventName) as distinct_apis, values(eventName) as events, values(sourceIPAddress) as src_ips, values(userAgent) as user_agents, min(_time) as first_seen, max(_time) as last_seen by actor, id_type, key_id, recipientAccountId
| eval sensitive_api_seen=if(match(mvjoin(events,","),"AssumeRole|GetSessionToken|RunInstances|SendCommand"),"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| sort - api_calls

Microsoft KQL

AWSCloudTrail
| where TimeGenerated > ago(24h)
| where UserAgent contains 'kali' or UserAgent contains 'parrot' or UserAgent contains 'pentoo' or UserAgent contains 'pacu'
| summarize ApiCalls=count(), DistinctApis=dcount(EventName), Events=make_set(EventName, 50), SourceIps=make_set(SourceIpAddress, 20), UserAgents=make_set(UserAgent, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserIdentityType, UserIdentityUserName, UserIdentityAccessKeyId, RecipientAccountId
| extend SensitiveApiSeen = set_has_element(Events, 'AssumeRole') or set_has_element(Events, 'GetSessionToken') or set_has_element(Events, 'RunInstances') or set_has_element(Events, 'SendCommand')
| order by ApiCalls desc

Sigma

title: AWS API Call From Offensive-Tool Operating System User-Agent
id: 7c1e5a52-3b0d-4f0e-9a4b-2d6f8e1a9c31
status: experimental
description: Detects AWS CloudTrail events whose user-agent contains Kali, Parrot, Pentoo or Pacu markers, as seen when a stolen long-lived IAM key was driven from aws-cli on Kali Linux.
references:
  - https://www.wiz.io/blog/blue-agent-data-exfiltration-investigation
author: Threadlinqs Team
date: 2026/09/29
tags:
  - attack.initial-access
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userAgent|contains:
      - 'kali'
      - 'parrot'
      - 'pentoo'
      - 'pacu'
  condition: selection
falsepositives:
  - Authorized red team or penetration test using Kali-based tooling against the AWS account
  - Security engineers running aws-cli from a Kali workstation
level: high

Known false positives:

• Authorized penetration tests or red-team exercises using Kali-based tooling
• Security staff running aws-cli from a Kali workstation

Tuning notes: Allow-list known red-team source IPs and engagement windows. Pair with the baseline-deviation detections so a Kali user-agent on a CI/CD identity escalates immediately.

• 🔒 Bulk Private Repository Clone by a Single GitHub Actor or IP · unlock with TL Creds
• 🔒 SSM SendCommand / StartSession From Non-Approved Source (Cloud Administration Command) · unlock with TL Creds
• 🔒 S3 Staging or Retrieval of Database/Billing Export Scripts (ops-tools) · unlock with TL Creds
• 🔒 svc_automation IAM Key Used Outside TeamCity / aws-sdk-go User-Agent Baseline · unlock with TL Creds
• 🔒 Execution of Database and Billing Export Python Scripts (mssql/pg/billing) · unlock with TL Creds
• 🔒 curl or wget Fetching Python Tools From an ops-tools Path (Ingress Tool Transfer) · unlock with TL Creds
• 🔒 IAM User Key Used for Cross-Account AssumeRole / GetSessionToken via aws-cli · unlock with TL Creds
• 🔒 Long-Lived AKIA Key Used From First-Seen Source IP (Baseline Deviation / VPN Egress) · unlock with TL Creds

Indicators of compromise

As of 2026-09-29, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-2772.

Technical analysis

Source: Wiz blog post "The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub" (published 2026-09-29). This is a vendor investigation write-up; there is no CVE, no named actor, and no vulnerability. The intrusion is credential abuse across GitHub and AWS.

Detection and triage: three detection rules fired at once against the same CI/CD service account: "Unusual User Access Through Third-Party VPN", "API Calls From Unusual Country" and "AWS Management API Calls by a Known Offensive Tool". The actor was svc_automation, an IAM service account created in 2018 for CI/CD pipelines, using a permanent AKIA-prefixed access key. The user agent identified aws-cli on Kali Linux (kali-amd64). The source IPs belonged to Zenlayer Inc, a hosting provider commonly associated with VPN exit nodes (ExpressVPN association noted), geolocated to Taiwan. Wiz's individual IP addresses were not published.

Baseline deviation: over a 30-day baseline, svc_automation had operated exclusively from three Amazon-owned IPs, using the user agents "TeamCity Server" and "aws-sdk-go" for routine CI/CD operations. During the detection window it appeared from unusual IPs, using aws-cli on Kali Linux, and attempted operations well outside its normal scope, including GetSessionToken, AssumeRole to an administrator role, SSM SendCommand and RunInstances.

Initial access: the article does not say how the GitHub token was compromised. A compromised token was used from the same Zenlayer IP to clone 18 private repositories, hours before the AWS activity. Wiz notes that private repositories frequently contain hardcoded AWS access keys, database connection strings and service-account configuration, and that the attacker may have extracted the svc_automation AKIA key directly from the cloned content. This is stated as a possibility, not a confirmed finding.

Cross-account movement and execution: at 09:52 UTC the actor performed AssumeRole to a CI role in a second AWS account. At 09:55 UTC it performed another AssumeRole to the CI role from a different Zenlayer IP. At 10:06 UTC it issued SSM SendCommand against a production EC2 instance, a Windows domain controller named PROD-*-DC1 in the article. Credential use led to command execution within about 14 minutes.

Tool staging and data targets: Blue Agent queried the data plane and found custom Python scripts staged in an S3 bucket: /ops-tools/mssql_table_export.py, /ops-tools/pg_table_export.py and /ops-tools/billing_export2.py. They were uploaded from Kali Linux, then retrieved and run by the compromised EC2 instances via curl from Amazon-owned IPs. The scripts target Microsoft SQL Server, PostgreSQL and billing data. Wiz describes an active data-exfiltration operation, but the article does not confirm that exfiltration completed or say where data was sent. The bucket name, account IDs and instance IDs were not disclosed.

Gaps: no attribution, no IP addresses, no hashes, and no confirmed victim identity or exfiltration destination are published.

MITRE ATT&CK techniques by tactic:

Execution

T1059.006 Python; T1651 Cloud Administration Command

Initial Access

T1078.004 Cloud Accounts

Privilege Escalation

T1078.004 Cloud Accounts

Command and Control

T1090 Proxy

Collection

T1119 Automated Collection; T1213.003 Code Repositories

Credential Access

T1552.001 Credentials In Files

Remediation

Immediate actions

• Revoke the compromised GitHub token and rotate every AWS access key (including svc_automation's AKIA key) found in any repository the token could read
• Review CloudTrail for AssumeRole, GetSessionToken, RunInstances and SSM SendCommand from non-baseline IPs or from user agents containing kali or aws-cli, and review the GitHub audit log for bulk repository clones
• Inspect the production domain controller (PROD-*-DC1) for SSM-executed commands and treat it as compromised until cleared
• Find and remove the staged scripts under /ops-tools/ (mssql_table_export.py, pg_table_export.py, billing_export2.py) in S3, and audit access to the SQL Server, PostgreSQL and billing data stores

Workarounds

• Apply an IAM deny or IP-condition policy to svc_automation until keys are rotated

Longer-term hardening

• Replace long-lived IAM user access keys for CI/CD with short-lived role-based credentials such as OIDC federation or instance roles
• Add secret scanning and push protection to GitHub, and remove hardcoded credentials from source
• Alert when a service account leaves its historical IP and user-agent baseline (for example TeamCity Server / aws-sdk-go from three Amazon-owned IPs)
• Restrict who can call ssm:SendCommand, and scope sts:AssumeRole trust policies for cross-account CI roles
• Add IP-condition policies on service-account keys and alert on third-party VPN and offensive-tool user agents

Affected and fixed versions

• Amazon Web Services — IAM / STS / Systems Manager / EC2 / S3 (customer accounts, credential misuse - not a service vulnerability)
• GitHub — Private repositories (token misuse - not a platform vulnerability)
• Microsoft — Windows Server domain controller (production, PROD-*-DC1) and SQL Server

Timeline

• 2026-09-29 Wiz published the Blue Agent investigation after three detection rules fired simultaneously (third-party VPN, unusual country, known offensive tool).
• 2026-09-29 Python scripts locked-ioc-4, locked-ioc-5 and locked-ioc-6 were found staged in S3 under /ops-tools/, uploaded from Kali Linux and retrieved and run by compromised EC2 instances via curl from Amazon-owned IPs. Date shown is the publication date.
• 2026-09-29 10:06 UTC: SSM SendCommand executed against a production Windows domain controller (PROD-*-DC1). Date shown is the publication date.
• 2026-09-29 09:55 UTC: further AssumeRole to the CI role from a different Zenlayer IP. Date shown is the publication date.
• 2026-09-29 09:52 UTC: AssumeRole to the CI role in a second AWS account, giving cross-account access. Date shown is the publication date.
• 2026-09-29 svc_automation's permanent AKIA key was used from aws-cli on Kali Linux (kali-amd64) from Zenlayer IPs, breaking a 30-day baseline of three Amazon-owned IPs with TeamCity Server / aws-sdk-go user agents. Date shown is the publication date.
• 2026-09-29 Hours before the AWS activity, a compromised GitHub token was used from a Zenlayer (Taiwan-geolocated) IP to clone 18 private repositories. Incident date not disclosed; date shown is the Wiz publication date.

Sources cited

• MITRE ATT&CK T1651 - Cloud Administration Command MITRE · Research · 2026-09-29
• MITRE ATT&CK T1552.001 - Unsecured Credentials: Credentials In Files MITRE · Research · 2026-09-29
• MITRE ATT&CK T1213.003 - Data from Information Repositories: Code Repositories MITRE · Research · 2026-09-29
• MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts MITRE · Research · 2026-09-29
• AWS Systems Manager Run Command documentation docs.aws.amazon.com · Vendor report · 2026-09-29
• AWS IAM security best practices (avoid long-lived access keys) docs.aws.amazon.com · Vendor report · 2026-09-29
• The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub Wiz · Blog · 2026-09-29

More in data breach

• Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform
• Railway cloud platform breach exposes customer secrets, leads to $740,000 in fraudulent AI charges (Wiz 'Black October' campaign)
• NEAR AI breach via SGLang remote code execution exposes ~100 user accounts and 18 legacy AI agents
• BYOD Ransomware Group Allegedly Claims Toyota Data Breach (Unverified)
• York University (Toronto) data breach exposes personal information submitted via 14 departmental web forms (2007-2026)

Previous and next in data breach

• Arizona Courts Cyberattack: Phishing-Led Intrusion Copies Backup Court Files Including Protective Order Data Previous report
• Frontline Education data breach via exploited third-party software vulnerability exposes school district employee SSNs Next report