Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
A skilled human attacker rapidly exploited a remote code execution vulnerability (CVE-2026-39987) in Marimo within eight seconds, pivoting from a vulnerable instance to an SSH bastion host. The attacker utilized a custom Python toolkit, bypassing automated defenses and executing over 850 commands to steal AWS credentials and gain SSH access. This highlights the continued relevance of skilled human operators in bypassing security measures, even as AI-assisted attacks become more prevalent.
A Sysdig Threat Research Team investigation revealed a concerning trend: a skilled human attacker swiftly exploited a remote code execution vulnerability (CVE-2026-39987) in Marimo, a web application, within just eight seconds. The attacker leveraged a custom Python toolkit, built and debugged entirely by hand, without relying on any AI-powered agent. This rapid response demonstrates that human expertise can still outpace automated defenses and quickly exploit vulnerabilities.
Upon gaining initial access, the attacker initiated a credential-pivot chain, utilizing the Marimo flaw to obtain a full interactive shell. Subsequently, they accessed Amazon Web Services (AWS) Secrets Manager, harvesting credentials, and then utilized SSH access to a bastion host, successfully retrieving a private key. The entire operation, spanning from 12:52 p.m. to 9:50 p.m., involved over 850 interactive commands and a single, backgrounded Python3 invocation that performed the entire process – pulling credentials, fetching the SSH key, and authenticating to the bastion – in one shot.
This finding comes as Hunt.io disclosed details of a cryptomining campaign targeting 3,562 Redis servers, utilizing a broad internet sweep to identify candidate hosts on port 6379 and deploying an XMRig miner via SLAVEOF command. The campaign also involved parallel pipelines: WordPress target discovery, AOF-based SSH authorized_keys injection, and Lua sandbox-escape probing.
The primary Redis exploitation method involved using the SLAVEOF command to smuggle attacker-controlled content, resulting in the deployment of an XMRig miner. The activity was linked to Redis versions 2.8.17 (2015) through 7.2.0 (2023) and Linux from EOL RHEL/CentOS 6 to current Ubuntu kernels, indicating a fundamental authentication weakness rather than a version-specific bug. A separate Operation CameraSwarm campaign, targeting over 14,000 Dahua IP cameras using brute-force attacks, authentication bypass flaws (CVE-2021-33044 and CVE-2021-33045), and a peer-to-peer (P2P) relay technique, further underscores the ongoing threat landscape.