Era Security dubs Greeter cloud campaign that leaves hello in logs
Original title: Attackers Say 'Hello' to a Different Scale of Cloud Attack
About 90% of nearly 3,000 scanned Flowise deployments were unpatched against critical code-injection flaw CVE-2024-58351.
Era Security researchers, after a Shodan search found open Amazon DynamoDB instances, reported a cloud attack campaign they named Greeter. Roughly 90% of nearly 3,000 scanned Flowise deployments ran unpatched versions vulnerable to CVE-2024-58351. Honeypots, mostly on AWS, observed attackers mapping privileges, hunting credentials, using cloud metadata services, setting persistence, and leaving short hello messages in logs. The article text cuts off before naming victims or a fix.
Unconfirmed: The truncated report does not confirm CVE-2024-58351 was the entry point used against the honeypots or name real victims.
- Researchers started from publicly exposed DynamoDB instances that allowed download or deletion.
- Flowise is an open-source platform for building LLM-powered AI agents.
- Era Security said realistic honeypots can now be built in about two hours.
- Attackers left benign-looking hello messages in logs to make detection harder.
Impact: Code injection on exposed Flowise and access to cloud credentials
| Product | Affected |
|---|---|
| Flowise | unpatched versions vulnerable to CVE-2024-58351 |
- 1.Identify internet-exposed Flowise deployments still vulnerable to CVE-2024-58351.
- 2.Restrict public access to Flowise and open Amazon DynamoDB instances.
- CVEs
- CVE-2024-58351
- Vendors
- Amazon Web Services
- Products
- FlowiseAmazon DynamoDB
- Organizations
- Era Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-58351 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web… | 9.3 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 7c184611bdd9df51982cc5bb2d5ba649 | vest-cloud-credentials#recipe=similar-items&sourcecontentid=7c184611bdd9df51982cc5bb2d5ba649) APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud |
| md5 | 8f99d4e59eef3c1106085563b00071e8 | t-mythos-exploit-storm#recipe=similar-items&sourcecontentid=8f99d4e59eef3c1106085563b00071e8) CSA: CISOs Should Prepare for Post-Mythos Exploit Storm b |
| md5 | dedc2d87d0611657e649f3ccd3b03e96 | rastructure-crime-bots#recipe=similar-items&sourcecontentid=dedc2d87d0611657e649f3ccd3b03e96) TeamPCP Turns Cloud Infrastructure Into Crime Bots by Jai |
| md5 | e89675326c5a58c3d1742cab0ff9c2e8 | ts-power-offensive-ops#recipe=similar-items&sourcecontentid=e89675326c5a58c3d1742cab0ff9c2e8) Attackers Seize Exposed AI Endpoints to Power Offensive O |
From the original article
8 min read at darkreading.com
Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.
By Arielle Waldman · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.