CriticalBreach · 2026-10-30

Northflank breached: assume every env var was decrypted

What happened

Northflank's status page tells customers to assume ALL environment variables were decrypted and to rotate every secret and API key. Users report stolen AI keys already being abused. Wiz's "Black October" report counts 9 AI developer platforms hit this month, including Railway and Warp.

Who's affected

Northflank customers, and anyone whose cloud/AI provider keys were stored there.

✅ Fix / patch

Revoke and rotate keys at the issuing provider, not just inside Northflank.
Check AI billing and CloudTrail InvokeModel calls for unexpected use.

🔎 Quick hunt check

Wiz says these IPs tested stolen keys (not tied directly to the breaches): 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=* sourcetype=aws:cloudtrail (sourceIPAddress IN ("23.106.46.239","38.246.114.118","104.243.32.50","31.57.201.201") OR (eventSource="bedrock.amazonaws.com" eventName IN ("InvokeModel","InvokeModelWithResponseStream","PutAccountDataRetention"))) | stats count min(_time) as first max(_time) as last by userIdentity.accessKeyId, sourceIPAddress, eventName

AWSCloudTrail
| where SourceIpAddress in ("23.106.46.239","38.246.114.118","104.243.32.50","31.57.201.201")
   or (EventSource == "bedrock.amazonaws.com" and EventName in ("InvokeModel","InvokeModelWithResponseStream"))
| summarize count(), min(TimeGenerated), max(TimeGenerated) by UserIdentityAccessKeyId, SourceIpAddress, EventName

source.ip:("23.106.46.239" or "38.246.114.118" or "104.243.32.50" or "31.57.201.201") or (event.provider:"bedrock.amazonaws.com" and event.action:("InvokeModel" or "InvokeModelWithResponseStream"))

⏱ CISA deadline

Not in CISA KEV as of Oct 31, 2026.