--- title: From CI/CD to Cloud Data: How Shai Hulud Persistence... description: FortiGuard Labs details a real-world attack chain where the Shai Hulud supply chain worm (attributed to TeamPCP, targeting npm/PyPI packages) compromised a... canonical: https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach | daily.dev og:description: FortiGuard Labs details a real-world attack chain where the Shai Hulud supply chain worm (attributed to TeamPCP, targeting npm/PyPI packages) compromised a... og:url: https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid og:image: https://api.daily.dev/og/posts/jmQfU4sId.png og:image:alt: From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach **[FortiGuard Threat Research](https://daily.dev/sources/fortiguard-threat-research)** · 13 min read · 1 upvotes · 0 comments ## Summary FortiGuard Labs details a real-world attack chain where the Shai Hulud supply chain worm (attributed to TeamPCP, targeting npm/PyPI packages) compromised a Jenkins CI/CD runner in May 2026, leading to full AWS account takeover and Amazon Redshift data exfiltration. The attacker stole EC2 instance metadata credentials, used them externally to escalate IAM privileges by creating a rogue 'cloudops-monitor' admin user, manipulated Aurora RDS and Redshift security groups, enumerated Secrets Manager for warehouse credentials, and ran ~90 Redshift Data API query cycles to exfiltrate data. Exfiltration tradecraft included explicitly named IAM policies (exfil-s3-write, exfil-s3-full) and STS session names (exfil, exfil10, exfil12). FortiCNAPP generated 1,095 observations correlated under a single 'Potentially Compromised Keys' alert. Defenders are advised to treat CI/CD runners as tier-0 identities, alert on external instance credential use, guard datastore control planes, and hunt attacker-named IAM artifacts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Shai Hulud supply chain worm lead to an AWS Redshift data breach? A Jenkins CI runner compromised by Shai Hulud had its EC2 instance role credentials stolen via the instance metadata service, then used from external IP addresses to create an admin IAM user named cloudops-monitor. The attacker modified Redshift and Aurora security groups to open network access, enumerated Secrets Manager for warehouse credentials, and ran roughly 90 ExecuteStatement calls via the Redshift Data API to collect and exfiltrate data. _Track emerging supply chain attack patterns like this one on daily.dev to harden CI/CD pipelines before they reach production._ ### What are the earliest warning signs that a CI/CD credential compromise has moved into cloud infrastructure? The clearest early signal is AWS instance credentials being used from a non-instance, external IP address rather than from the CI/CD host itself. In one documented case, a Jenkins EC2 instance role was invoked from an outside IP shortly after IMDS-based credential harvesting, followed within about two weeks by IAM privilege escalation, new admin user creation, and datastore reconnaissance. _Defenders monitoring CI/CD-to-cloud identity risk can follow incident breakdowns like this on daily.dev._ ### What IAM and STS naming patterns indicate active data exfiltration in AWS CloudTrail logs? Attacker activity was identified through inline IAM policies named exfil-s3-write and exfil-s3-full granting S3 PutObject, GetObject, ListBucket and DeleteObject permissions, plus STS AssumeRole sessions explicitly named exfil, exfil10, and exfil12 used for break-glass role access and SSM SendCommand execution on managed instances. _Security teams building detection rules for cloud exfiltration can dig into examples like these on daily.dev._ ## Similar posts on daily.dev - [Miasma: Red Hat Cloud Services npm Packages Hit by a Mini Shai-Hulud-Style Campaign](https://daily.dev/posts/miasma-red-hat-cloud-services-npm-packages-hit-by-a-mini-shai-hulud-style-campaign-4kacs0e4h) · Security Boulevard · 0 upvotes · 0 comments - [Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Pac...](https://daily.dev/posts/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-pac--jlxgalom3) · Socket · 0 upvotes · 0 comments - [How Cybercriminal Organizations Weaponize Exposed Secrets](https://daily.dev/posts/how-cybercriminal-organizations-weaponize-exposed-secrets-wrvbq5h3b) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#aws](https://daily.dev/tags/aws), [#cicd](https://daily.dev/tags/cicd), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach","url":"https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid"},"datePublished":"2026-06-26T13:11:46.829Z","dateModified":"2026-09-14T06:11:10.730Z","description":"FortiGuard Labs details a real-world attack chain where the Shai Hulud supply chain worm (attributed to TeamPCP, targeting npm/PyPI packages) compromised a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/72ac69745c2a01ebff0c6d69742672e8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/72ac69745c2a01ebff0c6d69742672e8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"FortiGuard Threat Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"FortiGuard Threat Research","logo":"https://media.daily.dev/image/upload/s--g8QQFZ6i--/f_auto,q_auto/v1780213347/logos/fortiguard-threat-research?_a=BAMAMiWQ0","url":"https://daily.dev/sources/fortiguard-threat-research"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,aws,cicd,iam","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"FortiGuard Threat Research","item":"https://daily.dev/sources/fortiguard-threat-research"},{"@type":"ListItem","position":3,"name":"From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid#faq","mainEntity":[{"@type":"Question","name":"How did the Shai Hulud supply chain worm lead to an AWS Redshift data breach?","acceptedAnswer":{"@type":"Answer","text":"A Jenkins CI runner compromised by Shai Hulud had its EC2 instance role credentials stolen via the instance metadata service, then used from external IP addresses to create an admin IAM user named cloudops-monitor. The attacker modified Redshift and Aurora security groups to open network access, enumerated Secrets Manager for warehouse credentials, and ran roughly 90 ExecuteStatement calls via the Redshift Data API to collect and exfiltrate data. Track emerging supply chain attack patterns like this one on daily.dev to harden CI/CD pipelines before they reach production."}},{"@type":"Question","name":"What are the earliest warning signs that a CI/CD credential compromise has moved into cloud infrastructure?","acceptedAnswer":{"@type":"Answer","text":"The clearest early signal is AWS instance credentials being used from a non-instance, external IP address rather than from the CI/CD host itself. In one documented case, a Jenkins EC2 instance role was invoked from an outside IP shortly after IMDS-based credential harvesting, followed within about two weeks by IAM privilege escalation, new admin user creation, and datastore reconnaissance. Defenders monitoring CI/CD-to-cloud identity risk can follow incident breakdowns like this on daily.dev."}},{"@type":"Question","name":"What IAM and STS naming patterns indicate active data exfiltration in AWS CloudTrail logs?","acceptedAnswer":{"@type":"Answer","text":"Attacker activity was identified through inline IAM policies named exfil-s3-write and exfil-s3-full granting S3 PutObject, GetObject, ListBucket and DeleteObject permissions, plus STS AssumeRole sessions explicitly named exfil, exfil10, and exfil12 used for break-glass role access and SSM SendCommand execution on managed instances. Security teams building detection rules for cloud exfiltration can dig into examples like these on daily.dev."}}]} ```