Threat video1:00
SGLang RCE Breaches NEAR AI Servers: Detection & IOCs
Attackers used an SGLang RCE to pivot into NEAR AI's internal systems; defenders can hunt it with 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for SGLang RCE Breaches NEAR AI Servers: Detection & IOCs →
Chapters
- 0:00The hookInference server breached: about 100 users' accounts downloaded.
- 0:05The storyAn attacker ran code on the server.
- 0:11Attack pathReported: an SGLang flaw let them run code.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise2 indicators to hunt: 1 package name and 1 hosting.
- 0:38MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to collection.
- 0:43Remediation4 steps now: Identify every SGLang deployment and restrict network exposure.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Inference server breached: about 100 users' accounts downloaded.
0:05An attacker ran code on the server.
0:07Then they reached Private Chat accounts.
0:11Reported: an SGLang flaw let them run code.
0:15Next, they pivoted into internal systems.
0:17Chat history and logs from 18 agents were taken.
0:21Two customers' API keys exposed in logs were revoked.
0:28No threat actor is attributed. Confidence: low.
0:332 indicators to hunt: 1 package name and 1 hosting.
0:386 ATT&CK techniques, from initial access to collection.
0:434 steps now: Identify every SGLang deployment and restrict network exposure.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.