Back to Articles

TL;DR

Initial access Stage 1: from an OpenAI evaluation sandbox to a rooted launchpad

Stage 2: Penetrating Hugging Face infrastructure using two injection vectors into our dataset processor

The kill chain

Day-by-day Day 1 (07-09): foothold and C2

Day 2 (07-10): self-referential search

Day 3 (07-11): lateral movement begins

Day 4 (07-12): using the stolen credentials

Day 5 (07-13): exfil, persistence, cleanup

Three lateral-movement techniques 1. Node impersonation and CSI token theft (from the prod-pod foothold)

2. Forged identity tokens (from the prod-pod foothold)

3. Supply-chain write access

Command-and-control and exfiltration Building an improvised message protocol

Evasion and self-migration

How we intercepted and analyzed the attack

What we changed

Reflection: the asymmetry problem

A companion technical writeup to our incident disclosure .…