"Eight seconds is the kind of speed we expect to see in AI-assisted attacks," the Sysdig Threat Research Team observed — and in a recent case they watched a human operator meet that mark without any AI agent in the loop.
Sysdig trace: eight seconds from Marimo RCE to bastion
Sysdig's investigation traced a credential-pivot chain in which a threat actor exploited CVE-2026-39987 — a pre-authenticated remote code execution bug affecting all versions of Marimo (CVSS score: 9.3) — and reached an SSH bastion in eight seconds after gaining a full interactive shell. The vendor's timeline shows a fresh WebSocket connection at 18:57:22, a lookup against the application's stored credential returning the harvested AWS key at 18:57:26, and SSH authentication observed at the bastion host at 18:57:30.
The broader session spanned from 12:52 p.m., when a first WebSocket connection was made from 172.236.12[.]17 to Marimo's /terminal/ws endpoint, until 9:50 p.m., during which the operator deployed an asyncssh-style listener against an attacker-owned VPS.
Hand-crafted tradecraft, not an AI agent
Sysdig emphasized that the operator "wrote and debugged by hand" a custom Python toolkit and issued more than 850 interactive commands over a nine-hour session. The activity used no recognizable publicly available offensive tooling. Instead, the attacker converged on "a single backgrounded Python3 invocation" that pulled credentials, fetched an SSH key from AWS Secrets Manager, wrote it to disk, and authenticated to the bastion in one shot.
Sysdig noted two implications: first, that skilled human operators can achieve "machine speed" post-exploit; and second, that such operators can sometimes better evade detections and avoid traps that caused agentic threat actors to fail against the same CVE.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCVE-2026-39987 and the speed of active exploitation
Sysdig reported CVE-2026-39987 came under active exploitation within hours of public disclosure. The chain observed combined a pre-authenticated RCE in Marimo with credential harvesting from a compromised instance, an AWS Secrets Manager call using those credentials, and SSH access to a bastion host via the retrieved private key — an end-to-end credential-pivot executed in rapid succession.
Parallel cryptomining activity identified by Hunt.io
In related activity, Hunt.io disclosed a large cryptomining campaign that compromised 3,562 Redis servers, likely following a broad internet sweep of candidate Redis hosts on port 6379. Hunt.io observed the campaign launching three parallel pipelines: WordPress target discovery (scanning HTTPS hosts for WordPress versions and plugins and for exposed XML-RPC or directory listings); AOF-based SSH authorized_keys injection using Redis's append-only file mode; and Lua sandbox-escape probing that ran Redis EVAL commands and escape attempts against hosts 47.250.92[.]230, 34.166.99[.]116, and 20.198.10[.]42.
Hunt.io described the primary exploitation method as using SLAVEOF replication to smuggle attacker-controlled content onto a target Redis server, which resulted in the deployment of an XMRig miner. The activity surfaced after an exposed working environment was discovered at 188.245.99[.]156.
Confirmed victims spanned Redis 2.8.17 (2015) through 7.2.0 (2023) and Linux from EOL RHEL/CentOS 6 to current Ubuntu kernels, indicating the weakness was missing authentication rather than a version-specific bug. Hunt.io said the toolkit ran four techniques across three services, but only Redis rogue replication worked at scale; SSH key-injection and MongoDB sandbox-escape returned zero across 2,810 attempts. A complete WordPress credential-to-webshell chain was recovered but not confirmed at scale.
What this means for security teams, enterprises, and defenders
- Security teams and technologists: The case demonstrates that an attacker can hand-roll exploit tooling, pivot through credential stores, and authenticate to high-value infrastructure in seconds — emphasizing detection and response windows measured in minutes or less.
- Enterprises and procurement leaders: Multiple attack threads — from Marimo RCE chains to Redis rogue replication and SSH key injection attempts — affected a wide range of software versions and OS kernels, underscoring that missing authentication and exposed services remain effective vectors regardless of software vintage.
- Defenders and incident response teams: Sysdig's observation that a human operator "walked straight past a trap" that agentic actors hit highlights that playbooks tuned to known automated behaviors may miss skilled manual operators who adapt in-session.
Sysdig and Hunt.io's findings together sketch two concurrent trends: attackers who move at machine pace without automated agents, and campaigns that exploit basic exposure and weak authentication at scale. The record here is concrete — CVE-2026-39987 was actively exploited within hours of disclosure, an operator completed a rapid credential-pivot to a bastion in eight seconds, and 3,562 Redis servers were compromised in a broad cryptomining campaign using rogue replication and SLAVEOF techniques. Those facts raise a pointed operational question for defenders: can monitoring, credential hygiene, and rapid containment keep pace with an operator who can chain compromises in single-digit seconds?
