# Multi-Platform Data Exfiltration Across AWS and GitHub via Stolen GitHub Token and Hardcoded AWS Credentials (Wiz Blue Agent Investigation)

> Wiz's Blue Agent traced an intrusion in which a compromised GitHub token was used to clone 18 private repositories, after which the long-lived AKIA key of the CI/CD IAM service account svc_automation was used from aws-cli on Kali Linux. The actor pivoted across two AWS accounts with AssumeRole, ran SSM SendCommand on a production Windows domain controller, and staged Python database/billing export scripts.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2772
- **ID:** TL-2026-2772
- **Severity:** CRITICAL
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Source: Wiz blog post "The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub" (published 2026-09-29). This is a vendor investigation write-up; there is no CVE, no named actor, and no vulnerability. The intrusion is credential abuse across GitHub and AWS.

Detection and triage: three detection rules fired at once against the same CI/CD service account: "Unusual User Access Through Third-Party VPN", "API Calls From Unusual Country" and "AWS Management API Calls by a Known Offensive Tool". The actor was svc_automation, an IAM service account created in 2018 for CI/CD pipelines, using a permanent AKIA-prefixed access key. The user agent identified aws-cli on Kali Linux (kali-amd64). The source IPs belonged to Zenlayer Inc, a hosting provider commonly associated with VPN exit nodes (ExpressVPN association noted), geolocated to Taiwan. Wiz's individual IP addresses were not published.

Baseline deviation: over a 30-day baseline, svc_automation had operated exclusively from three Amazon-owned IPs, using the user agents "TeamCity Server" and "aws-sdk-go" for routine CI/CD operations. During the detection window it appeared from unusual IPs, using aws-cli on Kali Linux, and attempted operations well outside its normal scope, including GetSessionToken, AssumeRole to an administrator role, SSM SendCommand and RunInstances.

Initial access: the article does not say how the GitHub token was compromised. A compromised token was used from the same Zenlayer IP to clone 18 private repositories, hours before the AWS activity. Wiz notes that private repositories frequently contain hardcoded AWS access keys, database connection strings and service-account configuration, and that the attacker may have extracted the svc_automation AKIA key directly from the cloned content. This is stated as a possibility, not a confirmed finding.

Cross-account movement and execution: at 09:52 UTC the actor performed AssumeRole to a CI role in a second AWS account. At 09:55 UTC it performed another AssumeRole to the CI role from a different Zenlayer IP. At 10:06 UTC it issued SSM SendCommand against a production EC2 instance, a Windows domain controller named PROD-*-DC1 in the article. Credential use led to command execution within about 14 minutes.

Tool staging and data targets: Blue Agent queried the data plane and found custom Python scripts staged in an S3 bucket: /ops-tools/mssql_table_export.py, /ops-tools/pg_table_export.py and /ops-tools/billing_export2.py. They were uploaded from Kali Linux, then retrieved and run by the compromised EC2 instances via curl from Amazon-owned IPs. The scripts target Microsoft SQL Server, PostgreSQL and billing data. Wiz describes an active data-exfiltration operation, but the article does not confirm that exfiltration completed or say where data was sent. The bucket name, account IDs and instance IDs were not disclosed.

Gaps: no attribution, no IP addresses, no hashes, and no confirmed victim identity or exfiltration destination are published.

## MITRE ATT&CK

- T1213.003 Code Repositories
- T1552.001 Credentials In Files
- T1078.004 Cloud Accounts
- T1078.004 Cloud Accounts
- T1651 Cloud Administration Command
- T1059.006 Python
- T1090 Proxy
- T1119 Automated Collection

## Sources

- [The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub](https://www.wiz.io/blog/blue-agent-data-exfiltration-investigation)
- [MITRE ATT&CK T1651 - Cloud Administration Command](https://attack.mitre.org/techniques/T1651/)
- [MITRE ATT&CK T1552.001 - Unsecured Credentials: Credentials In Files](https://attack.mitre.org/techniques/T1552/001/)
- [MITRE ATT&CK T1213.003 - Data from Information Repositories: Code Repositories](https://attack.mitre.org/techniques/T1213/003/)
- [MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
- [AWS Systems Manager Run Command documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/run-command.html)
- [AWS IAM security best practices (avoid long-lived access keys)](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2772