Selected Northflank 24.5/25 over Railway 24/25 and prior ConnectWise 23/25/ineligible. Verified platform-secret exposure guidance and reported unauthorized AI API-key use; cross-platform Black October pattern correlated without actor merge.
EVIDENCE
الأدلة وما تثبته
4 سجل
CSS-E-0005
Northflank opened a major security incident after a Wiz alert, told all users to assume environment variables had been decrypted and rotate all credentials, and reported unauthorized use of AI API keys supplied to the platform by multiple users.
UNKNOWN
Supports
Platform-secret exposure risk and realized downstream AI API-key misuse in reported cases.
Does not prove
Universal decryption/abuse of every secret, exact root cause, affected-customer denominator, or one actor behind related incidents.
Confidence
غير مسجل
Context
Northflank developer/cloud platform / environment variables / API keys
Wiz documented at least nine October developer-platform incidents, repeated targeting of stored environment variables and AI access, plus two downstream enterprise-credential abuse cases with roughly 2.5M Bedrock calls and >$100k usage; stolen keys also appeared in resale-related infrastructure.
UNKNOWN
Supports
Ecosystem-level monetization, repeated secret targeting and cross-platform pattern context.
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"Do not infer a vulnerability/misconfiguration without evidence.","Gap ID":"CSS-GAP-004","Impact":"Blocks definitive exploit/root-cause and preventive-control claims.","Status":"OPEN","Gap Type":"NORTHFLANK_ROOT_CAUSE","Priority":"HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-9F31C2A7","Description":"Exact initial-access, privilege-escalation and secret-decryption path for Northflank is not established in current public primary evidence.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"Northflank RCA/forensics, authentication/control-plane logs, network-policy failure path and secret-decryption audit trail."}
{"Notes":"Platform-wide rotation guidance is not a victim denominator.","Gap ID":"CSS-GAP-005","Impact":"Blocks prevalence/blast-radius/loss-rate claims.","Status":"OPEN","Gap Type":"AFFECTED_SCOPE_DENOMINATOR","Priority":"HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-9F31C2A7","Description":"No authoritative denominator distinguishes Northflank customers/secrets that were potentially exposed, actually decrypted, actually exfiltrated and actually abused.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"Customer/workspace counts, secret-level access logs, provider revocation/abuse telemetry and IR outcomes."}
FOLLOW-UP
المتابعات غير المحسومة
0 مفتوحة
لا توجد متابعة OPEN أو PLANNED لهذه الجولة.
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
Northflank-specific monetary loss, Northflank-specific root cause, or one actor/vulnerability behind all incidents.
Confidence
غير مسجل
Context
AI developer platforms / cloud secrets / LLMJacking ecosystem
Wiz Researchفتح المصدرCY-T2 / Primary Cloud Security Research
CSS-E-0007
Railway reported unauthorized internal-system access, decryption of a subset of stored environment variables using compromised credentials, targeting of AI/platform API keys, and an upper bound of 1.85% of workspaces (~100k) with some variables potentially compromised.
UNKNOWN
Supports
Independent validation that developer-platform secret stores can be breached and used to target downstream AI/platform credentials.
Does not prove
Same actor/access path as Northflank or any transferable Northflank blast-radius denominator.
Confidence
غير مسجل
Context
Railway developer platform / stored environment variables / AI keys
Fireworks AI confirmed unauthorized use of internal credentials and access to environment variables containing API keys/tokens in a limited number of customer accounts, followed by credential revocation and rotation.
{"Notes":"Rotation must be paired with downstream persistence review.","Gap ID":"CSS-GAP-006","Impact":"Blocks full impact and recovery assessment.","Status":"OPEN","Gap Type":"DOWNSTREAM_CREDENTIAL_ABUSE_BREADTH","Priority":"HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-9F31C2A7","Description":"Provider-by-provider breadth of unauthorized use, financial impact, downstream resource creation, data access and persistent access from Northflank-stored credentials remains unknown.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"AI/cloud/SaaS provider logs, billing, token/session activity, created-resource audit trails and customer IR evidence."}
{"Notes":"Pattern similarity is relation evidence, not identity proof.","Gap ID":"CSS-GAP-007","Impact":"Blocks cross-incident actor/campaign merge.","Status":"OPEN","Gap Type":"CAMPAIGN_IDENTITY_CORRELATION","Priority":"MEDIUM-HIGH","Domain ID":"CY-DOM-005","Topic IDs":"CY-TOP-CSS-9F31C2A7,CY-TOP-0801","Description":"Current evidence does not safely resolve whether Northflank and other October developer-platform incidents share one actor/campaign or only a common monetization/targeting pattern.","Last Reviewed":"2026-11-01","Resolution Run":"","Required Evidence / Resolution":"Shared infrastructure with temporal control, common payload/access artifacts, credential-use graph and authoritative attribution."}
NEW — Northflank primary incident evidence confirms emergency platform-wide secret rotation guidance and reported unauthorized AI API-key use. Exact root cause, affected-customer denominator, non-AI credential abuse breadth and cross-incident actor identity remain UNKNOWN/open.