Railway cloud platform breach exposes customer secrets, leads to $740,000 in fraudulent AI charges (Wiz 'Black October' campaign)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5687 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Black October - Stolen AI Key Abuse Against AWS Bedrock (Railway TL-2026-5687)

Behaviour-first CloudTrail search for post-theft use of AI provider credentials stolen in the Railway breach (Wiz Black October): one access key that both invokes Bedrock models and enumerates models or quotas (boto3-style ListFoundationModels, GetServiceQuota, PutAccountDataRetention) from a single address, or any Bedrock/quota call from the four Wiz-listed suspected key-validation IPs. Wiz observed a validation InvokeModel call within minutes of credential access, then low-volume daily calls. The Railway incident produced roughly 740,000 USD of unauthorized AI usage. IP IOCs are low confidence, so the behavioural branch is the primary signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1496.004, T1580, T1078.004, T1588.007
• Data sources: aws_cloudtrail (index=aws_cloudtrail, sourcetype=aws:cloudtrail), bedrock.amazonaws.com, servicequotas.amazonaws.com
• Severity: high
• Confidence: medium

Splunk SPL

index=aws_cloudtrail sourcetype="aws:cloudtrail" earliest=-24h eventSource IN ("bedrock.amazonaws.com","servicequotas.amazonaws.com","ec2.amazonaws.com") eventName IN ("InvokeModel","InvokeModelWithResponseStream","Converse","ConverseStream","ListFoundationModels","GetFoundationModelAvailability","PutAccountDataRetention","ListServiceQuotas","GetServiceQuota","DescribeInstanceTypeOfferings")
| rename userIdentity.accessKeyId as access_key_id, userIdentity.arn as principal_arn
| eval ioc_ip=if(in(sourceIPAddress,"23.106.46.239","38.246.114.118","104.243.32.50","31.57.201.201"),1,0)
| eval boto_agent=if(match(userAgent,"(?i)boto3|botocore"),1,0)
| eval is_invoke=if(like(eventName,"Invoke%") OR like(eventName,"Converse%"),1,0)
| eval is_enum=if(is_invoke=0,1,0)
| stats count as calls sum(is_invoke) as invoke_calls sum(is_enum) as enum_calls max(ioc_ip) as ioc_ip max(boto_agent) as boto_agent values(eventName) as api_calls values(userAgent) as user_agents min(_time) as first_seen max(_time) as last_seen by access_key_id principal_arn sourceIPAddress
| where ioc_ip=1 OR (invoke_calls>=1 AND enum_calls>=2)
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ioc_ips = dynamic(["23.106.46.239","38.246.114.118","104.243.32.50","31.57.201.201"]);
let enum_events = dynamic(["ListFoundationModels","GetFoundationModelAvailability","PutAccountDataRetention","ListServiceQuotas","GetServiceQuota","DescribeInstanceTypeOfferings"]);
let invoke_events = dynamic(["InvokeModel","InvokeModelWithResponseStream","Converse","ConverseStream"]);
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventSource in ("bedrock.amazonaws.com","servicequotas.amazonaws.com","ec2.amazonaws.com")
| where EventName in (enum_events) or EventName in (invoke_events)
| extend IsIocIp = SourceIpAddress in (ioc_ips), IsBoto = UserAgent has_any ("Boto3","Botocore"), IsEnum = EventName in (enum_events), IsInvoke = EventName in (invoke_events)
| summarize Calls = count(), EnumCalls = countif(IsEnum), InvokeCalls = countif(IsInvoke), IocIp = max(toint(IsIocIp)), BotoAgent = max(toint(IsBoto)), ApiNames = make_set(EventName, 20), UserAgents = make_set(UserAgent, 5), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserIdentityAccessKeyId, UserIdentityArn, SourceIpAddress
| where IocIp == 1 or (InvokeCalls >= 1 and EnumCalls >= 2)
| project FirstSeen, LastSeen, UserIdentityAccessKeyId, UserIdentityArn, SourceIpAddress, Calls, InvokeCalls, EnumCalls, IocIp, BotoAgent, ApiNames, UserAgents

Sigma

title: Black October Suspected Stolen-Key IP Calling AWS Bedrock or Quota APIs
id: 5c1d7a30-8e42-4b19-9f6a-2d3b71e0a501
status: experimental
description: Detects AWS Bedrock, Service Quotas or EC2 offering API calls originating from IP addresses Wiz lists as suspected stolen AI-key validation infrastructure in the Black October campaign (Railway incident TL-2026-5687). Low-confidence community IOCs, treat as a hunting lead.
references:
    - https://blog.railway.com/p/incident-report-october-security-incident
    - https://www.wiz.io/blog/black-october-for-ai-developer-platforms
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.impact
    - attack.t1496.004
    - attack.discovery
    - attack.t1580
    - attack.privilege-escalation
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_ip:
        sourceIPAddress:
            - '23.106.46.239'
            - '38.246.114.118'
            - '104.243.32.50'
            - '31.57.201.201'
    selection_api:
        eventSource:
            - 'bedrock.amazonaws.com'
            - 'servicequotas.amazonaws.com'
            - 'ec2.amazonaws.com'
    condition: selection_ip and selection_api
falsepositives:
    - IP reassigned to a legitimate tenant after the campaign window
    - Shared hosting address ranges reused by benign traffic
level: high

Known false positives:

• Platform or FinOps engineers legitimately running boto3 scripts that list Bedrock models, check quotas and invoke a model
• Shared hosting IPs reused by unrelated benign tenants after the campaign window

Tuning notes: Allow-list known automation principals and corporate egress ranges; raise the enum_calls threshold for platform teams; add keys that were ever stored as Railway variables to a watchlist; the IP list is low confidence so keep the behavioural branch enabled when IPs age out. Schedule every 15 minutes over a 24h window.

• 🔒 Black October - Build Sandbox Escape to Host Namespace (Exploitation) · unlock with TL Creds
• 🔒 Black October - Credential File Hunting on Orchestration Host · unlock with TL Creds
• 🔒 Black October - Connections to Suspected Stolen-Key IPs · unlock with TL Creds
• 🔒 Black October - Boto3 Bedrock and Quota Enumeration · unlock with TL Creds
• 🔒 Black October - Bulk Repository Copy (Source Code Theft) · unlock with TL Creds
• 🔒 Black October - DNS Lookups for Resale and ARTEX Domains · unlock with TL Creds
• 🔒 Black October - OIDC Role Assumption Followed by Bulk KMS Decrypt · unlock with TL Creds
• 🔒 Black October - One SSH Key or Source Accepted on Many Hosts (Lateral Movement) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5687.

Sample indicators (3 of 20)

• IP address: 23.106.46[.]239
• Domain: llm-routing[.]com
• IP address: 38.246.114[.]118

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Technical analysis

Railway's November 10, 2026 incident report describes a roughly 26-hour intrusion that Railway characterizes as a contest of 'agent speed'. The attacker began creating dummy accounts on October 18 (earlier attempts were blocked by automated systems) and started probing build infrastructure at 06:50 UTC on October 20. At 07:28 UTC a previously unknown vulnerability partially escaped filesystem isolation on a shared build VM, letting the attacker read a build credential intended only for registry pushes.

That build credential was accepted as a trusted client by Railway's internal self-hosted Temporal cluster. Using it, the attacker read the stored histories of 353 builds (including sealed variables) between 13:50 and 15:30 UTC and used build-cache APIs to retrieve a copy of Railway's internal monorepo. Railway's on-call engineer was paged at 13:58 UTC by an alert on anomalous registry API calls; builds were halted at 17:03 and the build credential was revoked and replaced at 17:28 UTC. The attacker reportedly analyzed the source code for further attack paths and probed long-dormant endpoints, using parallel probing with rapid retries and agent fan-outs.

On October 21 at 03:26 UTC the attacker obtained a short-lived cloud credential through a misconfigured OIDC binding, which yielded internal provisioning credentials. Between 04:07 and 05:21 UTC they queried the envelope-encrypted variables database over an internal VPC, filtering by regex on variable names (AI provider keys prioritized, with some queries targeting cloud, database and payment credentials) and favoring environments with many variables. A long-lived KMS-decryption credential found on disk on an orchestration machine (which also held a CD-pushed SSH key and VPC access) was used in windows 04:42-05:14 and 06:36-07:15 UTC to decrypt per-environment keys. Overbroad decryption meant any compromised credential could decrypt many environments' variables. Railway disabled all active cloud credentials and the key-decryption service at 07:14 UTC and fully evicted the attacker at 09:24-09:25 UTC; all user sessions and tokens were invalidated at 20:19 UTC.

Impact: environment variables potentially decrypted for at most 1.85% of workspaces (~100,000; an upper bound at environment level, not a confirmed count of stolen secrets); linked-account tokens (BYOK AI agent keys, GitHub OAuth tokens) for 1,852 users were exposed and reset; about $740,000 in unauthorized AI usage was estimated. Railway found no evidence that customer Git repositories were downloaded or customer databases accessed. Railway believes the attackers sought AI credentials for resale or model distillation. Railway links the incident to the campaign Wiz calls 'Black October', a wave of credential-theft incidents at AI developer platforms (also Northflank, OpenCode, Warp, Lightning AI and others); Wiz states it has not established that every incident is one coordinated campaign and that there is no common vulnerability. No threat actor is named and Railway has not published IOCs (they are being shared privately with law enforcement; an FBI IC3 complaint was filed and an external forensics firm is still investigating). No CVE has been assigned.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.004 SSH

Privilege Escalation

T1078.004 Cloud Accounts; T1611 Escape to Host

Collection

T1119 Automated Collection; T1213.003 Code Repositories

Impact

T1496.004 Cloud Service Hijacking

Credential Access

T1552.001 Credentials In Files

Discovery

T1580 Cloud Infrastructure Discovery

Resource Development

T1585.003 Cloud Accounts; T1588.007 Artificial Intelligence

Reconnaissance

T1595 Active Scanning

Remediation

Patches

• No customer-side patch; Railway has fixed the build isolation escape, rebuilt CI and rotated all internal credentials, PKI and root CA

Immediate actions

• Rotate all environment variables, API keys and secrets stored on Railway, prioritizing AI provider (OpenAI, Anthropic, Gemini, Bedrock, OpenRouter), cloud, database and payment credentials
• Rotate private container registry credentials stored on Railway
• Reset linked-account tokens (BYOK AI agent keys, GitHub OAuth tokens) if notified among the 1,852 affected users
• Review AI provider and cloud billing and usage logs for unexpected charges and report unauthorized charges to Railway and the provider for reimbursement
• Review service logs for unusual activity since October 20, 2026

Workarounds

• Revoke and re-issue any AI provider key that was ever stored as a Railway variable
• Pause or restrict affected AI provider accounts until keys are rotated

Longer-term hardening

• Scope AI provider keys to least privilege (restrict regional or cross-region inference profiles, model allow-lists, spend limits and quotas)
• Alert on AI provider API usage anomalies such as new source IPs, sudden call-volume spikes and model enumeration
• Avoid long-lived static secrets in PaaS environment variables; prefer short-lived or workload-identity credentials
• Treat build pipelines as untrusted multi-tenant boundaries: use dedicated ephemeral build VMs and credentials scoped to a single image push
• Audit OIDC trust bindings and keep decryption credentials off orchestration hosts

Affected and fixed versions

• Railway — Railway cloud platform (build infrastructure, environment variable store, linked-account tokens)
  Vulnerable versions: Platform state before October 21, 2026
  Fixed in: Remediated by vendor; builds restored October 22, 2026

Timeline

• 2026-10-18 Attacker begins creating dummy accounts on Railway; earlier attempts had been blocked by automated systems.
• 2026-10-20 13:58 UTC an alert on anomalous registry API calls pages the on-call engineer; builds halted at 17:03 and build credential revoked and replaced at 17:28 UTC.
• 2026-10-20 13:50-15:30 UTC the attacker uses the build credential against Railway's internal Temporal cluster to read stored histories of 353 builds and retrieves a copy of the internal monorepo via build-cache APIs.
• 2026-10-20 06:50 UTC probing of build infrastructure begins; at 07:28 UTC a previously unknown vulnerability partially escapes filesystem isolation on a shared build VM and the attacker reads an internal build credential.
• 2026-10-21 Attacker fully evicted at 09:24-09:25 UTC; Railway publishes initial security disclosure and pauses deployments; all user sessions and tokens invalidated at 20:19 UTC.
• 2026-10-21 A long-lived KMS-decryption credential found on an orchestration machine is used (04:42-05:14 and 06:36-07:15 UTC) to decrypt per-environment keys; Railway disables cloud credentials and key decryption at 07:14 UTC.
• 2026-10-21 03:26 UTC the attacker obtains a short-lived cloud credential through a misconfigured OIDC binding, then queries the envelope-encrypted variables database by regex on variable names (04:07-05:21 UTC).
• 2026-10-22 Railway publishes preliminary report and remediation guides telling customers to rotate all secrets; builds restored in phases by tier; new signups paused (reopened November 2).
• 2026-10-30 Wiz publishes 'Black October for AI Developer Platforms' tracking at least nine AI developer platform incidents including Railway; Northflank discloses unauthorized AI key use the same day.
• 2026-11-10 Railway publishes full incident report: up to 1.85% of workspaces (~100,000) potentially affected, 1,852 linked-account tokens exposed, ~$740,000 in fraudulent AI usage; FBI IC3 complaint filed and forensics ongoing.

Sources cited

• Railway Incident Report: October Security Incident blog.railway.com · Vendor report · 2026-11-10
• Wiz: "Black October" for AI Developer Platforms Wiz · Research · 2026-10-30
• Railway Security Disclosure (October 21st) blog.railway.com · Vendor report · 2026-10-21
• Railway Preliminary Report: October Security Incident blog.railway.com · Vendor report · 2026-10-22
• Railway changelog: October 21 security incident railway.com · Vendor report · 2026-10-23
• Railway breach leads to $740,000 in fraudulent AI charges BleepingComputer · News · 2026-11-10
• Railway warns devs to rotate secrets after potential breach BleepingComputer · News · 2026-10-22
• Northflank security breach leads to abuse of customers' AI API keys BleepingComputer · News · 2026-10-30

More in data breach

• Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform
• NEAR AI breach via SGLang remote code execution exposes ~100 user accounts and 18 legacy AI agents
• BYOD Ransomware Group Allegedly Claims Toyota Data Breach (Unverified)
• York University (Toronto) data breach exposes personal information submitted via 14 departmental web forms (2007-2026)
• Binance denies data breach after alleged ShinyHunters-branded data sale claim (335M user records)