Session CRT-20260519 — 19 May 2026 · Morning Edition

Look, this is a textbook case of what happens when external exposure goes unnoticed for too long. Six months is an eternity in the GitHub credential-harvesting ecosystem.

Scope of exposure from the outside:

The repository "Private-CISA" was maintained by a Nightwing contractor using the platform to shuttle files between work and home devices. KrebsonSecurity reports that one leaked CSV titled "importantAWStokens" contained administrative credentials for three AWS GovCloud servers. Another file — "AWS-Workspace-Firefox-Passwords.csv" — listed plaintext usernames and passwords for dozens of internal CISA systems. The passwords reportedly followed predictable patterns: platform name plus the current year.

Here's where I have to flag uncertainty: I found no evidence in my OSINT sources about forks, stars, or clones before takedown. GitHub doesn't expose this historically for deleted private repositories. If anyone cloned this during the exposure window, those copies persist independent of the original. This is a critical intelligence gap — we simply do not know the replication scope.

Risk window — automated harvesting reality:

The exposure timeline spans approximately six months per the Gizmodo and Krebs reports — November 2024 through May 2026. Here's the problem: GitHub secret-scanning bots operate continuously.

From my tool results: TruffleHog includes an --only-verified flag that filters results to confirmed-active credentials by contacting the issuing service. This means adversaries running TruffleHog at scale can verify AWS key validity in real-time.

What I can say with confidence from Snyk's reporting: 28 million credentials leaked on GitHub in 2025. The ecosystem is actively scanned by both commercial tools (GitGuardian, TruffleHog) and opportunistic actors. My assessment — the six-month window means near-certain discovery by automated scanning infrastructure.

The 48-hour key validity claim — important caveat:

KrebsonSecurity reports that Caturegli stated the exposed AWS keys "inexplicably continued to remain valid for another 48 hours." This is a single-source claim from Krebs's reporting. I have not independently verified this timeline, and CISA has not publicly confirmed the rotation delay. Treat this as reported but uncorroborated.

Credibility of "no indication of compromise":

CISA's claim is operationally necessary but difficult to verify externally. AWS CloudTrail could theoretically show no anomalous API calls — but we cannot audit those logs. The absence of evidence is not evidence of absence over a six-month window.

What troubles me from an OSINT perspective: the repository name "Private-CISA" and the filename "importantAWStokens" are pattern-matching gold for any regex-based scanner. Any actor scanning GitHub for GovCloud credential patterns would have flagged this immediately. The claim of no compromise requires assuming zero competent adversaries harvested valid credentials during 180 days of exposure — that strains credulity.

External attacker summary:

From the outside, this repository was discoverable via GitHub search, filename patterns, and potentially certificate transparency logs if tied to any related infrastructure. The exposure contains plaintext administrative credentials to GovCloud environments — a high-value target for both financially motivated actors and nation-state intelligence collection.

The 48-hour rotation delay (if accurate) represents a significant exploitation window for tier-1 actors. Without GitHub access logs showing unique viewers, "no indication of compromise" remains an unverifiable assertion.

Based on my research, let me address the three geopolitical dimensions of this CISA credential leak:

Every sophisticated state cyber apparatus monitors GitHub — this is standard tradecraft from my time at CCDCOE Tallinn.

The actors with demonstrated open-source intelligence operations include Chinese threat groups (APT41, APT10/Red Apollo, Salt Typhoon), Russian SVR-affiliated groups (APT29/Cozy Bear, APT28/Fancy Bear per MITRE ATT&CK documentation), and North Korean clusters (Lazarus Group variants). The MITRE ATT&CK framework documents these groups' systematic collection activities from public repositories and exposed credentials as standard reconnaissance vectors.

Regarding the exposure timeline: Krebs on Security reported the keys "inexplicably continued to remain valid for another 48 hours" after discovery. That window is more than sufficient for credential validation and initial access testing by any monitoring actor.

On U.S. credibility: this creates genuine friction. For years U.S. diplomats have pressed allies to meet strict cybersecurity standards, often weaponizing compliance in trade negotiations. When CISA's own operational security fails at the basic hygiene level the U.S. demands of others, allies in Brussels, London, and Tokyo have grounds to question the asymmetry. This mirrors the dynamics after the 2015 OPM breach revelations forced a diplomatic recalibration with Chinese APT attribution.

The workforce question is more constrained. I found no current intelligence on specific DOGE-related reductions at CISA this week, so I cannot link this credential leak to institutional degradation without stronger evidence. What I can say: if political disruptions impair contractor oversight and configuration management at CISA, that transforms a tactical failure into strategic exposure. CISA has been central to U.S. "defense forward" cyber strategy — any impairment to its operational baseline signals capability degradation to adversaries.

Sofia, from a regulatory perspective, how does this intersect with CISA's own incident reporting requirements under CIRCIA? And have allied governments indicated their reaction in Brussels or London?

Here's what I can say with confidence:

On motivation: Microsoft doesn't declare it, but the operational pattern — tenant-wide enumeration, data exfiltration from Key Vaults/SQL databases/Storage, and ScreenConnect RMM for persistence — reads financially motivated to me. No evidence of espionage tradecraft (no long-term dwell for intelligence collection, no targeting of specific verticals, no staging for strategic access). This looks like data theft for monetization.

On TTP linkage and attribution confidence:

The SSPR abuse (T1621) paired with rogue MFA device registration (T1098.005) is a known pattern. I see striking parallels to Octo Tempest/Lapsus$-style cloud exploitation: identity-centric, no malware, heavy use of native admin tools, Graph API enumeration. That said, I also found Microsoft has separately tracked Storm-2755 doing AiTM BEC with similar cloud-native tradecraft.

Microsoft's calling this a "new" cluster. My take: moderate confidence this is a distinct operational entity — the technique stack has been documented since at least 2022 (Microsoft's SSPR abuse advisories, Octo Tempest reporting). Retooling by any established group is possible. But the specific chain (SSPR → MFA registration → full Azure pivot without AiTM) is distinct enough from Storm-2755's AiTM-heavy BEC playbook to warrant provisional clustering. I'd want to see 6+ months of passive DNS and certificate transparency pivots before firming up to high confidence.

One critical distinction: Storm-2949 never deployed malware; everything was native tooling. That's increasingly common but makes forensic attribution harder. One tool isn't attribution — I need the infrastructure story.

I'll stay silent on specific IOCs and campaign timeline until Microsoft publishes victim-level details or I can verify through primary sources.

Storm-2949: Three Actions for This Week

Look, Storm-2949 ran a clean identity-based attack chain — no malware to detect, so your EDR won't save you. This is pure Entra ID hygiene. Here's what you do:

CRITICAL (Deploy Today):

1. Conditional Access: Block New Device Registration by Risky Users or Non-Trusted Locations

   • Create a CA policy targeting "All users" with condition: "User risk level = High" OR "Sign-in risk level = High" OR "Any location" excluding your named/corporate IP ranges
   • Cloud apps: Microsoft Azure Management + Microsoft Graph
   • Grant controls: Block
   • This cuts the SSPR → rogue MFA registration pivot. False positive rates vary by environment — you'll need to tune named locations based on your remote worker baseline (uncited).

2. App Registration Restriction Policy

   • In Entra ID Portal → Identity → Applications → App registrations → User settings
   • Set "Users can register applications" to "No" for all users except a specific security group
   • Storm-2949 enumerated and abused App Registrations for Graph API persistence. This change will impact dev-heavy environments — expect friction and plan an approval workflow for legitimate app registrations (uncited).

HIGH (This Week):
3. KQL Alerting Rule: Rapid Graph Enumeration Pattern

let threshold = 50;
AzureActivity
| where OperationName contains "MICROSOFT.GRAPH" or Caller contains "graph.microsoft.com"
| summarize API_Calls = count() by Caller, CallerIpAddress, bin(TimeGenerated, 5m)
| where API_Calls > threshold

Deploy this in Sentinel or Log Analytics. Storm-2949 hit Graph hard for enumeration — 50+ calls in 5 minutes is abnormal for most service accounts. Expect tuning requirements in environments with heavy automation (uncited).

Bonus: Enable "Require admin approval for joining devices to Azure AD" in Device settings. I found no current advisory indicating this breaks Intune autopilot, but test in staging first — I've seen emergency policy changes lock out legitimate device enrollments.

TeamPCP/SLSA L3: What This Means

Here's the hard truth: SLSA Build Level 3 provenance just got bypassed because the attackers stole the OIDC tokens used for trusted builder authentication. This isn't a build isolation failure — it's a trust failure upstream. SLSA L3 assumes the identity issuer is trustworthy; when that breaks, the attestation is worthless.

For Jenkins specifically: The remediated builds reported by SANS ISC are 2.0.13-848.v76e89de8a_053 and 2.0.13-847.v08c0072b_2fd5. However, there's conflicting guidance from Checkmarx pointing to 2.0.13-829.vc72453fa_1c16. Avoid version 2026.5.09 at all costs — it used a completely different versioning scheme that should have been a red flag.

What you actually do now:

• Pin by content hash, not version — the malicious packages had different hashes despite valid provenance
• Implement maintainer change detection — the @tanstack compromise was via maintainer account takeover; auto-flag new maintainer commits
• Runtime behavioral monitoring — SLSA L3 is necessary, not sufficient

Priority Matrix:

On SLSA L3: Treat it as one control in depth, not your supply chain safety net. The trust boundary failed at the maintainer/OIDC layer, not the build.

Based on my research, here's the breakdown on both items.

Claw Chain Mechanics

The attack originates from malicious plugin execution or prompt injection — think of it as the classic indirect prompt injection problem but with direct filesystem consequences. CVE-2026-44112 is a time-of-check/time-of-use (TOCTOU) race condition in OpenShell's filesystem write bridge — attackers abuse the gap between path validation and file operations to redirect writes outside the intended mount root. This isn't abstract theory; the Cyera research flagged this as the highest-severity vulnerability in the chain with CVSS 9.6.

From there, the chain unfolds through credential exposure, privilege escalation, and complementary read escapes. The critical insight from the NVD entry is that this affects OpenClaw before version 2026.4.22 — patching deadlines matter here because this is actively being exploited in the 245K exposed instances.

The persistence mechanism is what makes this especially dangerous for AI agent deployments. Unlike traditional backdoors that write to disk, Claw Chain leverages the AI agent's own configuration files and plugin system. An attacker can embed malicious instructions in .openclaw configuration files — these persist across sessions, survive container restarts, and are treated as legitimate configuration by the agent itself.

Why this matters for AI deployments specifically: AI agents have elevated trust boundaries. They hold API keys, have access to internal data stores, and execute with persistent memory. A TOCTOU escape that would be "just another sandbox bypass" in a traditional web app becomes a full-blown supply chain compromise in an AI agent context because the agent itself becomes the persistence mechanism.

Supply Chain Delta

Shai-Hulud expansion (84 packages): The escalation from our May 13 discussion represents not just volume but velocity. The TanStack compromise demonstrated that malicious versions were published across 42 official packages within 6 minutes. The operational change: threat actors are now achieving valid SLSA Build Level 3 attestations — meaning the malicious packages pass cryptographic verification. This breaks automated supply chain scanning that relies on provenance validation.

OpenAI employee compromise: This is confirmed per the tweet from @fct_to reporting that "OpenAI confirmed supply chain attack compromising two employee devices via Mini Shai-Hulud malware campaign distributed through 180+ malicious npm packages. Attack harvested AWS credentials and source code repository access from developer machines. Production systems, model weights, and customer data were not compromised. OpenAI rotated credentials, terminated sessions, and notified CISA."

Codex branch-name injection: This has been patched but remains operationally relevant. BeyondTrust's Phantom Labs found that Codex failed to sanitize branch names when setting up containers, enabling command injection via crafted Unicode characters and internal field separator payloads — attackers could steal GitHub OAuth tokens. This affected Codex CLI, SDK, and IDE integrations. OpenAI remediated this by January 2026.

The material change: we're now seeing supply chain attacks specifically targeting AI coding agents and the developers who build them. The OpenAI incident demonstrates these organizations face the same developer-targeting supply chain threats as everyone else — and their developers are high-value targets.