{ "type": "bundle", "id": "bundle--c84062d3-d745-4b74-b19f-26f0691035be", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-10-19T00:00:00.000Z", "name": "Zeabur, Inc.", "identity_class": "organization", "sectors": [ "technology" ], "contact_information": "https://zeabur.com/support", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ] }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0": "clear" } } }, { "type": "incident", "spec_version": "2.1", "id": "incident--1ed5ba7e-2ff6-46f4-8145-75f1236cd219", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Zeabur October 2026 security incident", "description": "On 2026-10-14/15 an attacker used leaked Zeabur internal credentials (AWS keys and non-expiring shared-cluster admin tokens stored in plaintext in a private configuration repository) to access the shared Kubernetes cluster in 9 regions, user database containers (865 database services), Zeabur's secrets management service (about 53 production secrets), 101 GCP Dedicated Servers (root sign-in), the Zeabur internal network (Tailscale), and finally the platform database (3,218,965 environment-variable records, 321,810 accounts). Last attacker activity observed: 2026-10-15T21:05Z.", "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ], "confidence": 85 }, { "type": "campaign", "spec_version": "2.1", "id": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Zeabur October 2026 intrusion", "description": "Activity cluster of the unidentified actor behind the Zeabur October 2026 incident. The actor made heavy use of rotating proxy servers; attribution is unknown. Observed intent: harvesting directly usable API keys, especially AI service keys (n8n credentials, new-api/one-api keys, Amazon Bedrock attempts).", "first_seen": "2026-10-14T01:36:00Z", "last_seen": "2026-10-15T21:05:00Z", "objective": "Harvest credentials and API keys (especially AI service keys) from a PaaS provider and its customers", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--17c7a956-f67b-4e20-bcb5-7be1c0f0f65e", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "related-to", "source_ref": "incident--1ed5ba7e-2ff6-46f4-8145-75f1236cd219", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c9ecdebf-1534-46ea-8c41-31ff4c0134f5", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unsecured Credentials: Credentials In Files", "description": "AWS keys and shared-cluster admin tokens were stored in plaintext in a private configuration repository.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552.001", "url": "https://attack.mitre.org/techniques/T1552/001/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a89c09a-c4ec-434b-b1fe-8505f3b132ed", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--c9ecdebf-1534-46ea-8c41-31ff4c0134f5", "confidence": 60 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Valid Accounts: Cloud Accounts", "description": "Leaked AWS keys, GCP service account keys and non-expiring Kubernetes admin tokens were used from the public internet.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.004", "url": "https://attack.mitre.org/techniques/T1078/004/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21c4b1fd-dd9c-4613-b8af-33449680230d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unsecured Credentials: Container API", "description": "Read settings and secrets (including environment variables) of all services through the shared-cluster Kubernetes API.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552.007", "url": "https://attack.mitre.org/techniques/T1552/007/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--10369962-45ea-4204-9c0b-aeaf6b02d479", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9e3ab753-6ec2-45b9-ba9b-f139eb19361a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Container Administration Command", "description": "Ran read commands (kubectl exec) inside 865 user database containers: n8n/PostgreSQL, PostgreSQL table-by-table, new-api/one-api, Redis, MongoDB, MariaDB.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1609", "url": "https://attack.mitre.org/techniques/T1609/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb355249-805a-435e-8f65-0d4f2ab1d193", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--9e3ab753-6ec2-45b9-ba9b-f139eb19361a", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3d4f0085-2239-4734-84c0-d1dc813bcb49", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Data from Cloud Storage", "description": "Read an old cluster backup with an over-privileged key (assessed); listed user database backups (tpe1, hkg1) and source uploads; obtained a customer database backup via a presigned URL on 2026-10-15T15:42Z.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1530", "url": "https://attack.mitre.org/techniques/T1530/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d309e616-ff3e-4d51-b3e2-3b5fd8c462c1", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--3d4f0085-2239-4734-84c0-d1dc813bcb49", "confidence": 60 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--aea25ffc-d13a-44ef-a5d8-300a8fc39bf7", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Credentials from Password Stores: Cloud Secrets Management Stores", "description": "Read about 53 production secrets from AWS secrets management, including internal-network admin credentials, a platform database account and the GitHub App private key.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555.006", "url": "https://attack.mitre.org/techniques/T1555/006/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21aba9c8-344c-40a0-ae5c-b67ec1afa044", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--aea25ffc-d13a-44ef-a5d8-300a8fc39bf7", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a70ac217-4a23-47c7-b720-329c28c68729", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unsecured Credentials", "description": "Root passwords stored in plaintext in GCP Dedicated Server initialization settings were read with an old GCP key (assessed).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552", "url": "https://attack.mitre.org/techniques/T1552/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--250fb7bf-69c5-4678-b42d-e70026fb0f26", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--a70ac217-4a23-47c7-b720-329c28c68729", "confidence": 60 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b5f11cf-d623-4bf5-84af-670d321ba1f5", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remote Services: SSH", "description": "Signed in as root to 101 GCP Dedicated Servers.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "lateral-movement" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1021.004", "url": "https://attack.mitre.org/techniques/T1021/004/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c9b09e8-13bb-407a-955a-39e3e5d0e2a0", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--6b5f11cf-d623-4bf5-84af-670d321ba1f5", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e3a67151-1a7b-4c52-bd93-9d477318b590", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Account Manipulation: SSH Authorized Keys", "description": "Added attacker-controlled SSH public keys (comment *@zeabur-pentest) to 50 servers and via GCP instance metadata.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098.004", "url": "https://attack.mitre.org/techniques/T1098/004/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3ab9753-6b32-404c-af98-c3144fa7c551", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--e3a67151-1a7b-4c52-bd93-9d477318b590", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3950a062-bd29-4b12-85e2-bcd39c6d6555", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "External Remote Services", "description": "Joined an attacker node to Zeabur's Tailscale internal network using stolen admin credentials, then reached the platform database.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38a46543-329b-4d17-a08b-68c27b515a45", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--3950a062-bd29-4b12-85e2-bcd39c6d6555", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Data from Information Repositories: Databases", "description": "Read the platform database with an internal read-only account (29 connections, 8,903 operations, 2026-10-15T16:10-16:47Z).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213.006", "url": "https://attack.mitre.org/techniques/T1213/006/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aff8df3d-d09c-4c7d-af90-fb19c186bbbe", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--719fa556-30f1-42b9-a868-745bdbe76225", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Forge Web Credentials", "description": "Assessed to have forged login credentials with the stolen signing key and called the Zeabur API as two accounts (2026-10-15T16:12-17:19Z).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1606", "url": "https://attack.mitre.org/techniques/T1606/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3f54f45-f07e-4c08-a0a3-e81cd2a3521f", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--719fa556-30f1-42b9-a868-745bdbe76225", "confidence": 60 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--85f5aabb-541d-485a-963f-c3269806b9ec", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Modify Cloud Compute Infrastructure: Create Cloud Instance", "description": "Created 5 VMs in Zeabur's GCP project.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1578.002", "url": "https://attack.mitre.org/techniques/T1578/002/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4f5d7a6d-d1e2-4228-b6ee-b3a651143804", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--85f5aabb-541d-485a-963f-c3269806b9ec", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0ce41da4-428c-4b4a-9392-ad956aaddfa2", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Modify Cloud Compute Infrastructure: Create Snapshot", "description": "Attached 16 copies of customer server disks to attacker-created VMs.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1578.001", "url": "https://attack.mitre.org/techniques/T1578/001/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--221ede44-5b3a-4edd-a49c-981488d79632", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--0ce41da4-428c-4b4a-9392-ad956aaddfa2", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--09ac4fb6-6aa3-43b3-8962-505002a01e45", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cloud Infrastructure Discovery", "description": "Enumerated AWS resources and storage with leaked keys; most requests were denied.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1580", "url": "https://attack.mitre.org/techniques/T1580/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a33a574-56dc-4990-8fa4-81de7a4f69bb", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--09ac4fb6-6aa3-43b3-8962-505002a01e45", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a252ecc1-abc6-4f4e-8cd0-140f17fdf169", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Resource Hijacking: Cloud Service Hijacking", "description": "Attempted to call Amazon Bedrock with Zeabur AWS keys; all attempts failed and no charges were incurred.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "impact" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1496.004", "url": "https://attack.mitre.org/techniques/T1496/004/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47653b1e-55ac-4c12-935f-5389c8c3304d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--a252ecc1-abc6-4f4e-8cd0-140f17fdf169", "confidence": 85 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a208f99f-a9fa-4d58-af6e-c96d4fe9be12", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Brute Force", "description": "SSH sign-in attempts to 3 Dedicated Servers on 2026-10-13T21:27-23:04Z, all failed. Link to the campaign is a hypothesis.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110", "url": "https://attack.mitre.org/techniques/T1110/" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c6997fc4-aa29-46bd-bae2-e41c28fceb5a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "attack-pattern--a208f99f-a9fa-4d58-af6e-c96d4fe9be12", "confidence": 15 }, { "type": "tool", "spec_version": "2.1", "id": "tool--311bed85-89d1-4603-acec-e92da8824652", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Boto3", "tool_types": [ "remote-access" ], "description": "AWS SDK for Python (Boto3/Botocore 1.43.111, Python 3.12.15, Linux 6.12.86+deb13-amd64) used with leaked AWS keys." }, { "type": "tool", "spec_version": "2.1", "id": "tool--737a8667-a781-422c-8281-12790df6cc5b", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "kubectl", "tool_types": [ "remote-access" ], "description": "Kubernetes client used with leaked admin tokens for API reads and exec into containers." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad7f83e9-1694-48bd-8458-8c5800193633", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "tool--311bed85-89d1-4603-acec-e92da8824652", "confidence": 85 }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--47f18565-4b3a-434e-a894-6385f34195ab", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "tool--737a8667-a781-422c-8281-12790df6cc5b", "confidence": 60 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--eb1ecac9-e64c-524c-b336-ccb944abc8ab", "value": "23.106.46.239" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8ff730bf-bcef-4499-bcc3-bf9e0adcf87d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 23.106.46.239", "description": "Cluster access, cloud APIs, SSH sign-ins. Unauthenticated Zeabur API attempts from 2026-10-12T12:52Z, SSH attempts 2026-10-13, first use of leaked AWS key 2026-10-14T01:36Z.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '23.106.46.239']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--709d10d4-aae8-4335-b3c7-0ba3c319833a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--8ff730bf-bcef-4499-bcc3-bf9e0adcf87d", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--9abececf-7932-49a5-b111-606d5d81a824", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--8ff730bf-bcef-4499-bcc3-bf9e0adcf87d", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85, "first_seen": "2026-10-12T12:52:00Z" }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--65e72de1-9c0a-5e4b-a359-f989f048c8e9", "value": "102.244.78.57" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--077500d8-643e-46e3-9a89-0ebc0b453367", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 102.244.78.57", "description": "Cloud APIs, GCP settings changes.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '102.244.78.57']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--90b67b79-87f4-43a9-8bb7-5981d5af0df2", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--077500d8-643e-46e3-9a89-0ebc0b453367", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--bc09f871-7717-426c-ab25-46ce829dbf29", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--077500d8-643e-46e3-9a89-0ebc0b453367", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--f719b84e-392d-5a18-b581-8391630c79d2", "value": "103.237.102.191" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5217245e-a3e6-4b65-918b-8d630f729313", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 103.237.102.191", "description": "Cluster access, cloud APIs. Browsed Zeabur unauthenticated on 2026-10-10T18:27Z; used an admin token on 2026-10-14.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '103.237.102.191']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a9ca5c5-72f4-4552-b6c6-672d0e925419", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--5217245e-a3e6-4b65-918b-8d630f729313", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--b57aa8b4-86c5-411e-af03-a925a1a1585b", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--5217245e-a3e6-4b65-918b-8d630f729313", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85, "first_seen": "2026-10-10T18:27:00Z" }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--84a2f09e-ece8-5aac-a537-3fc6ba2f089b", "value": "103.112.139.162" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1ccf5941-6330-422f-8415-80a554ae3124", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 103.112.139.162", "description": "First use of a shared-cluster admin token (2026-10-14T01:40Z).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '103.112.139.162']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--182112ab-5c17-4a8c-b8fa-af8e5afe3b43", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--1ccf5941-6330-422f-8415-80a554ae3124", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--d9dfcf44-82e6-4da9-a774-5a21683c2eb8", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--1ccf5941-6330-422f-8415-80a554ae3124", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--d0505fc6-876a-58c1-b0f4-d3fc22b8c86e", "value": "45.146.232.28" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--328ee083-c471-4c38-b5da-3716cc69d0a8", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 45.146.232.28", "description": "AWS key validation.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.146.232.28']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76bce5ec-9728-4a5b-9060-e4b2380c7a77", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--328ee083-c471-4c38-b5da-3716cc69d0a8", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--6d8cfd60-5e45-4da2-a30b-8f6d76bafd1a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--328ee083-c471-4c38-b5da-3716cc69d0a8", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--ed989dd3-e92b-5f2b-94c8-26a84f0a9ddf", "value": "216.98.11.198" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6e525a77-39ec-4a34-92d4-5bfc9421554c", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 216.98.11.198", "description": "Dedicated Server SSH sign-ins.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.98.11.198']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--194a38d2-99a0-4225-ad28-40e55d846615", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--6e525a77-39ec-4a34-92d4-5bfc9421554c", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--610a0e19-6bda-4e2d-abc5-7f02a0e8a1fc", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--6e525a77-39ec-4a34-92d4-5bfc9421554c", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--83ba0eff-d752-5a99-9a17-4c073ffb7030", "value": "45.58.38.175" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--88c7cb76-532b-4a1c-beea-f02ab12316c6", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 45.58.38.175", "description": "Dedicated Server SSH sign-ins.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.58.38.175']", "pattern_type": "stix", "valid_from": "2026-10-14T01:36:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31fd5f0e-03a2-45fb-87c9-c72ffe2d76d3", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--88c7cb76-532b-4a1c-beea-f02ab12316c6", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--f584f41b-a35a-4ea0-81a4-a6dbc073ae7d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--88c7cb76-532b-4a1c-beea-f02ab12316c6", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--cae984d9-8650-58ba-a9c8-c649a6b78e27", "value": "52.220.72.188" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8969d398-4edd-4508-8980-79596e8be6e9", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 52.220.72.188", "description": "Callback address of the program planted in at least 2 PostgreSQL databases in Tokyo (hnd1), from 2026-10-14T01:51Z, still connecting at 2026-10-15T16:24Z.", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '52.220.72.188']", "pattern_type": "stix", "valid_from": "2026-10-14T01:51:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--921a737a-abee-4c6e-9c87-a09fc562341e", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--8969d398-4edd-4508-8980-79596e8be6e9", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--22b56a5e-e555-4d4c-84ae-18fe8d25e07a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--8969d398-4edd-4508-8980-79596e8be6e9", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 85, "first_seen": "2026-10-14T01:51:00Z", "last_seen": "2026-10-15T16:24:00Z" }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--3cd55f52-0eab-536b-83c3-718d799c59e7", "value": "31.57.201.201" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b2f45446-ba5f-4748-a5f8-be2463041143", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker IP 31.57.201.201", "description": "Root-password sign-ins to GCP Dedicated Servers on 2026-09-01..05 (about 98 servers on 09-05). Link to this campaign cannot be confirmed.", "indicator_types": [ "anomalous-activity" ], "pattern": "[ipv4-addr:value = '31.57.201.201']", "pattern_type": "stix", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2027-01-13T21:05:00Z", "confidence": 30, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--604107c6-ead6-4eff-8ea8-3cd91e635509", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "related-to", "source_ref": "indicator--b2f45446-ba5f-4748-a5f8-be2463041143", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 30 }, { "type": "sighting", "spec_version": "2.1", "id": "sighting--8ddf780a-2a66-4a58-ae23-8927f2b3c091", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "sighting_of_ref": "indicator--b2f45446-ba5f-4748-a5f8-be2463041143", "where_sighted_refs": [ "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98" ], "confidence": 30, "first_seen": "2026-09-01T00:00:00Z", "last_seen": "2026-09-05T23:59:59Z" }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Rotating proxy infrastructure", "infrastructure_types": [ "anonymization" ], "description": "Proxy servers used by the attacker; IPs may be shared with unrelated users, so an IP match alone does not prove attribution." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7eb3d07b-8ccc-41c4-910e-def6eb29bdae", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--eb1ecac9-e64c-524c-b336-ccb944abc8ab" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be74f0ca-eb30-4ed1-871f-4126fa282b7e", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--65e72de1-9c0a-5e4b-a359-f989f048c8e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--abe49766-dd1c-4571-97ba-ac99d64da035", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--f719b84e-392d-5a18-b581-8391630c79d2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60f70dfc-7cdd-481b-8565-0d0a59623c9d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--84a2f09e-ece8-5aac-a537-3fc6ba2f089b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--133d5a56-9679-4cd7-b309-f03ce2e0b907", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--d0505fc6-876a-58c1-b0f4-d3fc22b8c86e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df1761f1-0a42-4f6c-be2c-5eecf5509dbc", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--ed989dd3-e92b-5f2b-94c8-26a84f0a9ddf" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a73dbd7c-e1bc-4008-bfd6-611a0189bbc1", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "target_ref": "ipv4-addr--83ba0eff-d752-5a99-9a17-4c073ffb7030" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aaf28da0-ecc8-4822-a74d-1ca397223ebd", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "confidence": 85 }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--a4fdb044-12bf-4b50-a740-f0562b6bf63b", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "PostgreSQL implant callback host", "infrastructure_types": [ "command-and-control" ], "description": "External host that a program planted in shared-cluster PostgreSQL databases (hnd1) connected back to. Whether the entry point was a password leaked in August cannot be confirmed." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f217cbca-6fbb-4ebc-b194-0a5c83c613b5", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "consists-of", "source_ref": "infrastructure--a4fdb044-12bf-4b50-a740-f0562b6bf63b", "target_ref": "ipv4-addr--cae984d9-8650-58ba-a9c8-c649a6b78e27" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7d302a7-9c63-4577-a987-0f90573f1e7f", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "uses", "source_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "target_ref": "infrastructure--a4fdb044-12bf-4b50-a740-f0562b6bf63b", "confidence": 85 }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--542c9c64-8c04-4955-b0da-995bc6fb846b", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker SSH public key (*@zeabur-pentest)", "description": "SSH key added by the attacker to Dedicated Servers (authorized_keys and GCP instance metadata). Fingerprint SHA256:EdBc0uephoOMemIRKK0SRV2TRR45n52tJm1yErVU1iM.", "indicator_types": [ "malicious-activity" ], "pattern_type": "pcre", "pattern": "^\\S+ \\S+ \\S*@zeabur-pentest$", "valid_from": "2026-10-14T13:40:00Z", "confidence": 85, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f24f71eb-50af-4f92-b7f2-063a171b178f", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--542c9c64-8c04-4955-b0da-995bc6fb846b", "target_ref": "attack-pattern--e3a67151-1a7b-4c52-bd93-9d477318b590", "confidence": 85 }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bffc9386-3b2e-472c-8ea2-f82011dcd909", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--542c9c64-8c04-4955-b0da-995bc6fb846b", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 85 }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad9959f6-9cbb-4f6e-9c13-90145be25202", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Attacker AWS client User-Agent", "description": "CloudTrail userAgent seen with leaked AWS keys, e.g. 'Boto3/1.43.111 md/Botocore#1.43.111 ua/2.1 os/linux#6.12.86+deb13-amd64 md/arch#x86_64 lang/python#3.12.15 md/pyimpl#CPython m/b,e,D,Z cfg/retry-mode#legacy Botocore/1.43.111'. The m/ feature list varies per call and S3 events wrap the string in []. Low specificity on its own; combine with source IP and key.", "indicator_types": [ "anomalous-activity" ], "pattern_type": "stix", "pattern": "[network-traffic:extensions.'http-request-ext'.request_header.'User-Agent' LIKE '%Boto3/1.43.111 md/Botocore#1.43.111 ua/2.1 os/linux#6.12.86+deb13-amd64 md/arch#x86_64 lang/python#3.12.15%']", "valid_from": "2026-10-14T01:36:00Z", "confidence": 60, "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7f3505e4-916a-415a-9ec1-dbe066dbfe6a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--ad9959f6-9cbb-4f6e-9c13-90145be25202", "target_ref": "tool--311bed85-89d1-4603-acec-e92da8824652" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c92d6b1a-e419-49a2-9d1b-3630ed743bb0", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "indicates", "source_ref": "indicator--ad9959f6-9cbb-4f6e-9c13-90145be25202", "target_ref": "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "confidence": 60 }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9b37f1d7-ecaa-4ff7-a9eb-4e6f9df80870", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Restrict shared-cluster admin interface to Zeabur systems", "description": "2026-10-15 14:43-15:56Z." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e11b93c4-b257-4daa-bc5b-244c59f41eb3", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9b37f1d7-ecaa-4ff7-a9eb-4e6f9df80870", "target_ref": "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58993733-7a6a-4fa1-90ae-bef5c3421207", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9b37f1d7-ecaa-4ff7-a9eb-4e6f9df80870", "target_ref": "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--acf8c54f-c6b3-4f0a-9a3b-a7c937573127", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9b37f1d7-ecaa-4ff7-a9eb-4e6f9df80870", "target_ref": "attack-pattern--9e3ab753-6ec2-45b9-ba9b-f139eb19361a" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--df04832c-fa51-4f2e-a5e6-9593a6cce70a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Revoke and rotate cluster admin tokens", "description": "Revoked 15:32Z, rotated again 21:47Z; dedicated clusters limited to Zeabur systems 21:46Z." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3d7e4515-bb42-49b6-9afe-1d07318893a2", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--df04832c-fa51-4f2e-a5e6-9593a6cce70a", "target_ref": "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2724d75-54f1-41b9-ae94-7566516f1537", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--df04832c-fa51-4f2e-a5e6-9593a6cce70a", "target_ref": "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8d67340a-a466-4241-838f-0c1d90b3169b", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--df04832c-fa51-4f2e-a5e6-9593a6cce70a", "target_ref": "attack-pattern--9e3ab753-6ec2-45b9-ba9b-f139eb19361a" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--931f98a3-d06c-45d8-a2b3-73519620d8dc", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Disable leaked GCP keys", "description": "Disabled the two GCP keys used at 17:17Z and 17:31Z." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b67be9fd-2962-4ecf-872f-c876c34e75e9", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--931f98a3-d06c-45d8-a2b3-73519620d8dc", "target_ref": "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--659f71d9-a1a3-42f1-b93d-4433f252ac33", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--931f98a3-d06c-45d8-a2b3-73519620d8dc", "target_ref": "attack-pattern--e3a67151-1a7b-4c52-bd93-9d477318b590" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07195d64-ed49-499b-840a-3cecd660318a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--931f98a3-d06c-45d8-a2b3-73519620d8dc", "target_ref": "attack-pattern--85f5aabb-541d-485a-963f-c3269806b9ec" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dc300602-39ea-4a89-88fc-8e8d271a6c3d", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--931f98a3-d06c-45d8-a2b3-73519620d8dc", "target_ref": "attack-pattern--0ce41da4-428c-4b4a-9392-ad956aaddfa2" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a2808710-42d0-4e4c-b483-8ed65adb6da9", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remove attacker internal-network node", "description": "Removed the node and revoked the credential that created it at 17:58Z; platform database connections restricted to specific services." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2a14c9d-36bb-477b-acfb-e85c91560390", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a2808710-42d0-4e4c-b483-8ed65adb6da9", "target_ref": "attack-pattern--3950a062-bd29-4b12-85e2-bcd39c6d6555" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8395cfa5-0c41-4954-9b36-e78ff3b334a6", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a2808710-42d0-4e4c-b483-8ed65adb6da9", "target_ref": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b836a0d6-bd8e-4bd8-8772-a694bacf58b8", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Delete cluster backup access key; stop storing plaintext secrets in backups", "description": "Deleted 18:51Z; backup keys now stored separately." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4db00012-724c-4954-8393-0523ea9c9618", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b836a0d6-bd8e-4bd8-8772-a694bacf58b8", "target_ref": "attack-pattern--3d4f0085-2239-4734-84c0-d1dc813bcb49" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--73b984e8-362c-412f-adfe-78493a5f1516", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remove root passwords from GCP server initialization settings; block public SSH", "description": "18:55Z and 20:34-20:36Z; default service account permissions removed; root passwords reset." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--594e645e-2f4c-4620-bfa8-93090671cc2a", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--73b984e8-362c-412f-adfe-78493a5f1516", "target_ref": "attack-pattern--a70ac217-4a23-47c7-b720-329c28c68729" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cb68e55b-a6d6-4fb4-a6f5-4b499ed5c997", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--73b984e8-362c-412f-adfe-78493a5f1516", "target_ref": "attack-pattern--6b5f11cf-d623-4bf5-84af-670d321ba1f5" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Disable 24 AWS keys and reissue narrower keys", "description": "20:05-21:22Z." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c45d484-61a4-4a9f-b1c8-9669df2ff6fc", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "target_ref": "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1858a13b-f4e1-4739-bdbb-e900245ee5bc", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "target_ref": "attack-pattern--3d4f0085-2239-4734-84c0-d1dc813bcb49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--211c3992-7064-44ab-80bc-498e6d509ea2", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "target_ref": "attack-pattern--09ac4fb6-6aa3-43b3-8962-505002a01e45" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--668c0b05-cd22-43ff-9621-53482a594a60", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "target_ref": "attack-pattern--a252ecc1-abc6-4f4e-8cd0-140f17fdf169" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbe0c21e-614c-4b8d-85ca-1f0c99d42b12", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "target_ref": "attack-pattern--aea25ffc-d13a-44ef-a5d8-300a8fc39bf7" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c4da82e2-4e15-4c8b-ad22-bf11f3ec86c4", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Rotate login signing key; sign out all users; revoke all Access Tokens", "description": "Signing key rotated 20:25Z." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--df264bbb-9932-42b3-92b1-bb18402d70b7", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c4da82e2-4e15-4c8b-ad22-bf11f3ec86c4", "target_ref": "attack-pattern--719fa556-30f1-42b9-a868-745bdbe76225" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ef09ebe2-b380-4ed0-b89d-f8b0041cb534", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Rotate GitHub App private key, payment key, GitHub OAuth secret; revoke zSend, Hetzner and DigitalOcean tokens", "description": "18:54Z, 20:47Z, 2026-10-16 01:09Z." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce690e49-1394-4cd8-8466-2505d7961d0b", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ef09ebe2-b380-4ed0-b89d-f8b0041cb534", "target_ref": "attack-pattern--aea25ffc-d13a-44ef-a5d8-300a8fc39bf7" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--362fc112-e8ca-4f59-b859-51b0ed4c2eec", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: rebuild compromised GCP Dedicated Servers", "description": "Remove *@zeabur-pentest or unknown keys from /root/.ssh/authorized_keys; check google-sudoers, system accounts, crontab, systemd services and k3s workloads; change root password and disable SSH password login." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1e81e527-a885-4d92-8339-5e01840d8d48", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--362fc112-e8ca-4f59-b859-51b0ed4c2eec", "target_ref": "attack-pattern--e3a67151-1a7b-4c52-bd93-9d477318b590" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b462c3ac-32ee-433e-be91-deca0f4bb4d6", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--362fc112-e8ca-4f59-b859-51b0ed4c2eec", "target_ref": "attack-pattern--6b5f11cf-d623-4bf5-84af-670d321ba1f5" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--525779d1-4e25-4955-a7b7-9b4679589c53", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: rotate every credential stored on Zeabur", "description": "Revoke old keys at the provider first; change passwords inside databases; rotate n8n encryption key and recreate n8n credentials; revoke new-api/one-api upstream keys; audit PostgreSQL roles, functions, triggers, jobs and extensions." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--48867406-16b0-4b11-9b28-bee1d4d334e1", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--525779d1-4e25-4955-a7b7-9b4679589c53", "target_ref": "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a385a348-7bc2-455c-ab5b-c1a06dfdfc90", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--525779d1-4e25-4955-a7b7-9b4679589c53", "target_ref": "attack-pattern--9e3ab753-6ec2-45b9-ba9b-f139eb19361a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4afc45a-24ab-4a21-873b-79e8be920e72", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--525779d1-4e25-4955-a7b7-9b4679589c53", "target_ref": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e39db923-7718-47ca-9ee7-f37d316be5cb", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: recreate Zeabur Access Tokens and zSend API keys", "description": "All platform Access Tokens and all 566 zSend API keys were revoked. Sign in again, create new Access Tokens and zSend API keys, and check for unknown requests." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f5ca0c3-0fcf-41a4-a33c-a0f1f445f457", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e39db923-7718-47ca-9ee7-f37d316be5cb", "target_ref": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c882c157-e819-40b2-9981-4bcbffb422ab", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e39db923-7718-47ca-9ee7-f37d316be5cb", "target_ref": "attack-pattern--719fa556-30f1-42b9-a868-745bdbe76225" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--36cc22bf-e1b2-4667-a732-7a2c97264363", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: review GitHub audit logs for Zeabur GitHub App activity", "description": "Check activity from the Zeabur GitHub App between 2026-10-15T15:05Z and 18:54Z: unexpected clones or pushes, new deploy keys and modified webhooks." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--65d4897b-85cd-4205-b645-9424f2956c79", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--36cc22bf-e1b2-4667-a732-7a2c97264363", "target_ref": "attack-pattern--aea25ffc-d13a-44ef-a5d8-300a8fc39bf7" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--cc8b929e-0975-42ea-985b-5431851c7d6c", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: review usage and billing of every service", "description": "Check usage and billing from 2026-10-14 onwards (GCP Dedicated Server users from 2026-09-01). The credentials may have leaked earlier, so check earlier records as well if available." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db3bfa50-a79b-44a4-bf55-a80ea6deaeba", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cc8b929e-0975-42ea-985b-5431851c7d6c", "target_ref": "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--094d65c2-ed47-4bc3-b257-c53cb1d403e5", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cc8b929e-0975-42ea-985b-5431851c7d6c", "target_ref": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c4a49034-e353-4c05-a7b7-65509808a230", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: check Hetzner and DigitalOcean Dedicated Servers", "description": "In the provider console, check whether the root password was reset or the system reinstalled after 2026-10-14, and apply the GCP Dedicated Server checks for unknown sign-in methods." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f726d987-78ba-4304-a3c1-9b69a1a02abf", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c4a49034-e353-4c05-a7b7-65509808a230", "target_ref": "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1" }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ccb3f888-559a-429a-ab8a-63c9207a5d04", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Customer action: treat Taipei (tpe1) and Hong Kong (hkg1) database backups as exposed", "description": "Treat the data in database backups of the tpe1 and hkg1 regions as leaked and rotate any credentials or secrets stored in them." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79e69ced-abc0-4d77-a03c-5b5b1933552b", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ccb3f888-559a-429a-ab8a-63c9207a5d04", "target_ref": "attack-pattern--3d4f0085-2239-4734-84c0-d1dc813bcb49" }, { "type": "note", "spec_version": "2.1", "id": "note--398f384d-40df-4e3a-984a-46990dc2a702", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "abstract": "Hypothesis: initial credentials came from the August 2026 GitHub App private key leak", "content": "The GitHub App private key was read on 2026-08-27 and replaced on 2026-08-31; plaintext AWS keys and cluster admin tokens in the configuration repository were not rotated. No direct evidence. Counter-evidence: August and October attacker IPs do not overlap. The configuration repository was also downloaded via an employee's GitHub authorization on 2026-08-30 and 2026-09-02 (downloader unknown); GitHub Support was asked for records and did not reply.", "object_refs": [ "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "attack-pattern--c9ecdebf-1534-46ea-8c41-31ff4c0134f5" ], "authors": [ "Zeabur, Inc." ], "confidence": 15 }, { "type": "note", "spec_version": "2.1", "id": "note--83d829a1-c481-4739-8c44-52379522df16", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "abstract": "Hypothesis: 2026-10-10..13 probing was reconnaissance by the same actor", "content": "103.237.102.191 and 23.106.46.239 appear both in pre-incident probing and in credential use. Proxy IPs may be shared, so IP overlap alone does not prove the same operator.", "object_refs": [ "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "attack-pattern--a208f99f-a9fa-4d58-af6e-c96d4fe9be12" ], "authors": [ "Zeabur, Inc." ], "confidence": 15 }, { "type": "note", "spec_version": "2.1", "id": "note--6d399448-ce85-44df-a6a9-63d4c8ccf611", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "abstract": "Hypothesis: a decommissioned service's deploy key read the configuration repository on 2026-10-15T15:02Z", "content": "Occurred during production-secret reads; the service had been decommissioned for four months. No record directly links it to the attacker.", "object_refs": [ "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "attack-pattern--c9ecdebf-1534-46ea-8c41-31ff4c0134f5" ], "authors": [ "Zeabur, Inc." ], "confidence": 15 }, { "type": "note", "spec_version": "2.1", "id": "note--708092a7-edd4-4990-9ef1-72613eccbd22", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "abstract": "Open questions and investigation limits (as of the final report, 2026-11-03)", "content": "1) How the initial credentials were obtained: GitHub audit logs record archive downloads but not clones; the configuration repository was downloaded via an employee's GitHub authorization on 2026-08-30 and 2026-09-02, downloader unknown; GitHub Support did not reply. 2) Where the old GCP key leaked from: git history, the secrets management service and old cluster backups were checked, no leak point found; whether the 2026-09 root sign-ins from 31.57.201.201 were the same actor is unresolved. 3) How much was actually read from shared-cluster databases: audit logs keep commands, not output. 4) Download scope of backups and storage objects: a customer database backup was obtained via a presigned URL on 2026-10-15T15:42Z; for tpe1/hkg1 database backups and source uploads only listing is confirmed; old cluster backup read remains assessed; object access logging was not enabled. 5) GCP read activity: Data Access audit logs were not enabled; only writes are recorded. 6) Use of Hetzner and DigitalOcean tokens: no operation audit API; apart from Hetzner operations on 2026-10-15 confirmed as customers' own or scheduled jobs, unknown. 7) Whether the GitHub App private key was used: full organization audit logs not obtained; GitHub Support did not reply. 8) What platform database queries returned: queries, row counts of 7 main queries and 14 collections returning data are confirmed; returned content and later use are unknown. 9) Activity on the Taipei (tpe0) cluster and the dedicated cluster where the attacker created resources: incomplete audit logs; not investigated further. 10) What happened before 2026-10-14: no valid-credential use before 2026-10-14T01:36Z; some IPs appear in unauthenticated API logs from 2026-10-10 and SSH attempts on 2026-10-13 all failed; exposure in that period cannot be confirmed.", "object_refs": [ "incident--1ed5ba7e-2ff6-46f4-8145-75f1236cd219", "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2" ], "authors": [ "Zeabur, Inc." ] }, { "type": "report", "spec_version": "2.1", "id": "report--0813d834-2cdb-4cf5-b40a-85e53299ebb5", "created": "2026-10-19T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--b4881b84-7a7a-4ae6-af37-e6481713ae98", "object_marking_refs": [ "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Zeabur October 2026 security incident", "description": "Machine-readable summary of Zeabur's public incident report (final, 2026-11-03). Confidence: Confirmed=85, Assessed=60, Cannot be confirmed=30, Hypothesis=15. Representative IOCs only; the attacker used rotating proxies.", "published": "2026-11-03T00:00:00Z", "report_types": [ "attack-pattern", "campaign", "indicator", "threat-report" ], "object_refs": [ "incident--1ed5ba7e-2ff6-46f4-8145-75f1236cd219", "campaign--c2d077fe-f679-4c3f-bd58-9d0bf13ca6c2", "relationship--17c7a956-f67b-4e20-bcb5-7be1c0f0f65e", "attack-pattern--c9ecdebf-1534-46ea-8c41-31ff4c0134f5", "relationship--0a89c09a-c4ec-434b-b1fe-8505f3b132ed", "attack-pattern--b2813848-3841-44f1-bc83-a417cc40cb0d", "relationship--21c4b1fd-dd9c-4613-b8af-33449680230d", "attack-pattern--986376b8-c69b-48f9-ba19-1160966a4581", "relationship--10369962-45ea-4204-9c0b-aeaf6b02d479", "attack-pattern--9e3ab753-6ec2-45b9-ba9b-f139eb19361a", "relationship--bb355249-805a-435e-8f65-0d4f2ab1d193", "attack-pattern--3d4f0085-2239-4734-84c0-d1dc813bcb49", "relationship--d309e616-ff3e-4d51-b3e2-3b5fd8c462c1", "attack-pattern--aea25ffc-d13a-44ef-a5d8-300a8fc39bf7", "relationship--21aba9c8-344c-40a0-ae5c-b67ec1afa044", "attack-pattern--a70ac217-4a23-47c7-b720-329c28c68729", "relationship--250fb7bf-69c5-4678-b42d-e70026fb0f26", "attack-pattern--6b5f11cf-d623-4bf5-84af-670d321ba1f5", "relationship--7c9b09e8-13bb-407a-955a-39e3e5d0e2a0", "attack-pattern--e3a67151-1a7b-4c52-bd93-9d477318b590", "relationship--e3ab9753-6b32-404c-af98-c3144fa7c551", "attack-pattern--3950a062-bd29-4b12-85e2-bcd39c6d6555", "relationship--38a46543-329b-4d17-a08b-68c27b515a45", "attack-pattern--98680e84-2fd8-47be-8641-5992b2d288e1", "relationship--aff8df3d-d09c-4c7d-af90-fb19c186bbbe", "attack-pattern--719fa556-30f1-42b9-a868-745bdbe76225", "relationship--d3f54f45-f07e-4c08-a0a3-e81cd2a3521f", "attack-pattern--85f5aabb-541d-485a-963f-c3269806b9ec", "relationship--4f5d7a6d-d1e2-4228-b6ee-b3a651143804", "attack-pattern--0ce41da4-428c-4b4a-9392-ad956aaddfa2", "relationship--221ede44-5b3a-4edd-a49c-981488d79632", "attack-pattern--09ac4fb6-6aa3-43b3-8962-505002a01e45", "relationship--9a33a574-56dc-4990-8fa4-81de7a4f69bb", "attack-pattern--a252ecc1-abc6-4f4e-8cd0-140f17fdf169", "relationship--47653b1e-55ac-4c12-935f-5389c8c3304d", "attack-pattern--a208f99f-a9fa-4d58-af6e-c96d4fe9be12", "relationship--c6997fc4-aa29-46bd-bae2-e41c28fceb5a", "tool--311bed85-89d1-4603-acec-e92da8824652", "tool--737a8667-a781-422c-8281-12790df6cc5b", "relationship--ad7f83e9-1694-48bd-8458-8c5800193633", "relationship--47f18565-4b3a-434e-a894-6385f34195ab", "ipv4-addr--eb1ecac9-e64c-524c-b336-ccb944abc8ab", "indicator--8ff730bf-bcef-4499-bcc3-bf9e0adcf87d", "relationship--709d10d4-aae8-4335-b3c7-0ba3c319833a", "sighting--9abececf-7932-49a5-b111-606d5d81a824", "ipv4-addr--65e72de1-9c0a-5e4b-a359-f989f048c8e9", "indicator--077500d8-643e-46e3-9a89-0ebc0b453367", "relationship--90b67b79-87f4-43a9-8bb7-5981d5af0df2", "sighting--bc09f871-7717-426c-ab25-46ce829dbf29", "ipv4-addr--f719b84e-392d-5a18-b581-8391630c79d2", "indicator--5217245e-a3e6-4b65-918b-8d630f729313", "relationship--4a9ca5c5-72f4-4552-b6c6-672d0e925419", "sighting--b57aa8b4-86c5-411e-af03-a925a1a1585b", "ipv4-addr--84a2f09e-ece8-5aac-a537-3fc6ba2f089b", "indicator--1ccf5941-6330-422f-8415-80a554ae3124", "relationship--182112ab-5c17-4a8c-b8fa-af8e5afe3b43", "sighting--d9dfcf44-82e6-4da9-a774-5a21683c2eb8", "ipv4-addr--d0505fc6-876a-58c1-b0f4-d3fc22b8c86e", "indicator--328ee083-c471-4c38-b5da-3716cc69d0a8", "relationship--76bce5ec-9728-4a5b-9060-e4b2380c7a77", "sighting--6d8cfd60-5e45-4da2-a30b-8f6d76bafd1a", "ipv4-addr--ed989dd3-e92b-5f2b-94c8-26a84f0a9ddf", "indicator--6e525a77-39ec-4a34-92d4-5bfc9421554c", "relationship--194a38d2-99a0-4225-ad28-40e55d846615", "sighting--610a0e19-6bda-4e2d-abc5-7f02a0e8a1fc", "ipv4-addr--83ba0eff-d752-5a99-9a17-4c073ffb7030", "indicator--88c7cb76-532b-4a1c-beea-f02ab12316c6", "relationship--31fd5f0e-03a2-45fb-87c9-c72ffe2d76d3", "sighting--f584f41b-a35a-4ea0-81a4-a6dbc073ae7d", "ipv4-addr--cae984d9-8650-58ba-a9c8-c649a6b78e27", "indicator--8969d398-4edd-4508-8980-79596e8be6e9", "relationship--921a737a-abee-4c6e-9c87-a09fc562341e", "sighting--22b56a5e-e555-4d4c-84ae-18fe8d25e07a", "ipv4-addr--3cd55f52-0eab-536b-83c3-718d799c59e7", "indicator--b2f45446-ba5f-4748-a5f8-be2463041143", "relationship--604107c6-ead6-4eff-8ea8-3cd91e635509", "sighting--8ddf780a-2a66-4a58-ae23-8927f2b3c091", "infrastructure--3e8e8d9f-ecd0-454a-9b2c-b608b1dd6665", "relationship--7eb3d07b-8ccc-41c4-910e-def6eb29bdae", "relationship--be74f0ca-eb30-4ed1-871f-4126fa282b7e", "relationship--abe49766-dd1c-4571-97ba-ac99d64da035", "relationship--60f70dfc-7cdd-481b-8565-0d0a59623c9d", "relationship--133d5a56-9679-4cd7-b309-f03ce2e0b907", "relationship--df1761f1-0a42-4f6c-be2c-5eecf5509dbc", "relationship--a73dbd7c-e1bc-4008-bfd6-611a0189bbc1", "relationship--aaf28da0-ecc8-4822-a74d-1ca397223ebd", "infrastructure--a4fdb044-12bf-4b50-a740-f0562b6bf63b", "relationship--f217cbca-6fbb-4ebc-b194-0a5c83c613b5", "relationship--e7d302a7-9c63-4577-a987-0f90573f1e7f", "indicator--542c9c64-8c04-4955-b0da-995bc6fb846b", "relationship--f24f71eb-50af-4f92-b7f2-063a171b178f", "relationship--bffc9386-3b2e-472c-8ea2-f82011dcd909", "indicator--ad9959f6-9cbb-4f6e-9c13-90145be25202", "relationship--7f3505e4-916a-415a-9ec1-dbe066dbfe6a", "relationship--c92d6b1a-e419-49a2-9d1b-3630ed743bb0", "course-of-action--9b37f1d7-ecaa-4ff7-a9eb-4e6f9df80870", "relationship--e11b93c4-b257-4daa-bc5b-244c59f41eb3", "relationship--58993733-7a6a-4fa1-90ae-bef5c3421207", "relationship--acf8c54f-c6b3-4f0a-9a3b-a7c937573127", "course-of-action--df04832c-fa51-4f2e-a5e6-9593a6cce70a", "relationship--3d7e4515-bb42-49b6-9afe-1d07318893a2", "relationship--c2724d75-54f1-41b9-ae94-7566516f1537", "relationship--8d67340a-a466-4241-838f-0c1d90b3169b", "course-of-action--931f98a3-d06c-45d8-a2b3-73519620d8dc", "relationship--b67be9fd-2962-4ecf-872f-c876c34e75e9", "relationship--659f71d9-a1a3-42f1-b93d-4433f252ac33", "relationship--07195d64-ed49-499b-840a-3cecd660318a", "relationship--dc300602-39ea-4a89-88fc-8e8d271a6c3d", "course-of-action--a2808710-42d0-4e4c-b483-8ed65adb6da9", "relationship--c2a14c9d-36bb-477b-acfb-e85c91560390", "relationship--8395cfa5-0c41-4954-9b36-e78ff3b334a6", "course-of-action--b836a0d6-bd8e-4bd8-8772-a694bacf58b8", "relationship--4db00012-724c-4954-8393-0523ea9c9618", "course-of-action--73b984e8-362c-412f-adfe-78493a5f1516", "relationship--594e645e-2f4c-4620-bfa8-93090671cc2a", "relationship--cb68e55b-a6d6-4fb4-a6f5-4b499ed5c997", "course-of-action--ed8773f2-ac21-40f5-88bf-8c2af369dc6f", "relationship--0c45d484-61a4-4a9f-b1c8-9669df2ff6fc", "relationship--1858a13b-f4e1-4739-bdbb-e900245ee5bc", "relationship--211c3992-7064-44ab-80bc-498e6d509ea2", "relationship--668c0b05-cd22-43ff-9621-53482a594a60", "relationship--cbe0c21e-614c-4b8d-85ca-1f0c99d42b12", "course-of-action--c4da82e2-4e15-4c8b-ad22-bf11f3ec86c4", "relationship--df264bbb-9932-42b3-92b1-bb18402d70b7", "course-of-action--ef09ebe2-b380-4ed0-b89d-f8b0041cb534", "relationship--ce690e49-1394-4cd8-8466-2505d7961d0b", "course-of-action--362fc112-e8ca-4f59-b859-51b0ed4c2eec", "relationship--1e81e527-a885-4d92-8339-5e01840d8d48", "relationship--b462c3ac-32ee-433e-be91-deca0f4bb4d6", "course-of-action--525779d1-4e25-4955-a7b7-9b4679589c53", "relationship--48867406-16b0-4b11-9b28-bee1d4d334e1", "relationship--a385a348-7bc2-455c-ab5b-c1a06dfdfc90", "relationship--f4afc45a-24ab-4a21-873b-79e8be920e72", "note--398f384d-40df-4e3a-984a-46990dc2a702", "note--83d829a1-c481-4739-8c44-52379522df16", "note--6d399448-ce85-44df-a6a9-63d4c8ccf611", "note--708092a7-edd4-4990-9ef1-72613eccbd22", "course-of-action--e39db923-7718-47ca-9ee7-f37d316be5cb", "relationship--5f5ca0c3-0fcf-41a4-a33c-a0f1f445f457", "relationship--c882c157-e819-40b2-9981-4bcbffb422ab", "course-of-action--36cc22bf-e1b2-4667-a732-7a2c97264363", "relationship--65d4897b-85cd-4205-b645-9424f2956c79", "course-of-action--cc8b929e-0975-42ea-985b-5431851c7d6c", "relationship--db3bfa50-a79b-44a4-bf55-a80ea6deaeba", "relationship--094d65c2-ed47-4bc3-b257-c53cb1d403e5", "course-of-action--c4a49034-e353-4c05-a7b7-65509808a230", "relationship--f726d987-78ba-4304-a3c1-9b69a1a02abf", "course-of-action--ccb3f888-559a-429a-ab8a-63c9207a5d04", "relationship--79e69ced-abc0-4d77-a03c-5b5b1933552b" ], "external_references": [ { "source_name": "Zeabur October 2026 security incident", "url": "https://zeabur.com/en-US/blogs/october-2026-security-incident" } ] } ] }