Threat video1:00
Railway Secrets Breach Black October: Detection & IOCs
Railway's October breach let an attacker decrypt customer secrets and run up $740,000 in AI charges; 9 detection rules, 20 IOCs and a free Splunk SPL rule.
Read the full threat intel for Railway Secrets Breach Black October: Detection & IOCs →
Chapters
- 0:00The hookRoughly $740,000 in AI charges.
- 0:05The storyAn attacker chained flaws and credentials.
- 0:12Attack pathAccording to Railway's report, a VM escape exposed a registry build credential.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise15 indicators to hunt: 4 IPs, 6 domains and 5 hostings.
- 0:39MITRE ATT&CK techniques11 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation5 steps now: Rotate all environment variables, API keys and secrets stored.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Roughly $740,000 in AI charges.
0:05An attacker chained flaws and credentials.
0:08Up to 1.85% of workspaces affected.
0:12According to Railway's report, a VM escape exposed a registry build credential.
0:18Next, a misconfigured OIDC binding yielded a cloud credential.
0:23An on-disk decryption key unlocked customer variables.
0:29No threat actor is attributed. Confidence: low.
0:3315 indicators to hunt: 4 IPs, 6 domains and 5 hostings.
0:3911 ATT&CK techniques, from reconnaissance to impact.
0:445 steps now: Rotate all environment variables, API keys and secrets stored.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.