SockAnalystNorthflank breached: assume every env var was decrypted
SockAnalyst · Security+ certified analyst.
What happened
Northflank's status page tells customers to assume ALL environment variables were decrypted and to rotate every secret and API key. Users report stolen AI keys already being abused. Wiz's "Black October" report counts 9 AI developer platforms hit this month, including Railway and Warp.
Who's affected
Northflank customers, and anyone whose cloud/AI provider keys were stored there.
✅ Fix / patch
- Revoke and rotate keys at the issuing provider, not just inside Northflank.
- Check AI billing and CloudTrail InvokeModel calls for unexpected use.
🔎 Quick hunt check
Wiz says these IPs tested stolen keys (not tied directly to the breaches): 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201.
MITRE ATT&CK: T1552.001, T1078.004, T1496
IOCs
- IP addresses:
23.106.46[.]239,38.246.114[.]118,104.243.32[.]50,31.57.201[.]201
Wiz says these IPs tested stolen keys; not tied directly to the breaches.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=* sourcetype=aws:cloudtrail (sourceIPAddress IN ("23.106.46.239","38.246.114.118","104.243.32.50","31.57.201.201") OR (eventSource="bedrock.amazonaws.com" eventName IN ("InvokeModel","InvokeModelWithResponseStream","PutAccountDataRetention"))) | stats count min(_time) as first max(_time) as last by userIdentity.accessKeyId, sourceIPAddress, eventNameAWSCloudTrail
| where SourceIpAddress in ("23.106.46.239","38.246.114.118","104.243.32.50","31.57.201.201")
or (EventSource == "bedrock.amazonaws.com" and EventName in ("InvokeModel","InvokeModelWithResponseStream"))
| summarize count(), min(TimeGenerated), max(TimeGenerated) by UserIdentityAccessKeyId, SourceIpAddress, EventNamesource.ip:("23.106.46.239" or "38.246.114.118" or "104.243.32.50" or "31.57.201.201") or (event.provider:"bedrock.amazonaws.com" and event.action:("InvokeModel" or "InvokeModelWithResponseStream"))⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed · Breach · 2026-11-04
- Chainalysis discloses breach of customer contact data · Breach · 2026-10-30
- MUJI app breach: up to 27.26M customer records · Breach · 2026-10-30
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free