Threat video1:00
NEAR AI Breach Through SGLang Flaw: Detection & IOCs
Attackers used an SGLang flaw to reach a retired NEAR AI Private Chat backend. Spot it with 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for NEAR AI Breach Through SGLang Flaw: Detection & IOCs →
Chapters
- 0:00The hookNEAR AI breached: about 100 user accounts.
- 0:04The storyAttacker got into one inference server.
- 0:10Attack pathAn SGLang flaw gave an attacker a foothold.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise4 indicators to hunt: 3 URLs and 1 package name.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to collection.
- 0:43Remediation4 steps now: Revoke all active sessions and administrative credentials on AI inference.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00NEAR AI breached: about 100 user accounts.
0:05Attacker got into one inference server.
0:07Then moved to a retired feature's system.
0:11An SGLang flaw gave an attacker a foothold.
0:14Commands ran, then reached Private Chat.
0:17About 100 users' details downloaded.
0:1918 legacy agents' data was accessed.
0:22Two customers' API keys were in logs.
0:28No threat actor is attributed. Confidence: low.
0:334 indicators to hunt: 3 URLs and 1 package name.
0:385 ATT&CK techniques, from initial access to collection.
0:434 steps now: Revoke all active sessions and administrative credentials on AI inference.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.