Attackers Say 'Hello' to a Different Scale of Cloud Attack

Summary

Greeter is a reported cloud and AI-infrastructure attack campaign investigated by Era Security using honeypots deployed primarily on AWS. Dark Reading describes an organized progression from environment and privilege discovery through credential hunting, cloud metadata-service abuse, and persistence. Activity across several AWS regions at once supports treating the report as a campaign narrative, although no named threat actor is established.^[0]

The investigation began with exposed DynamoDB instances discovered through Shodan and led researchers to Flowise, an open-source platform for building LLM-powered agents. Approximately 90% of nearly 3,000 scanned Flowise deployments reportedly ran unpatched versions vulnerable to the critical code-injection flaw identified as CVE-2024-58351. This percentage describes the researchers' scanned population, not a demonstrated prevalence across all Flowise installations.^[0]

The operational concern extends beyond the application vulnerability. Researchers described attackers seeking cloud credentials and lateral movement, using cloud metadata services across multiple providers to escalate access, and establishing persistence. Seemingly benign, short-lived 'hello' log messages reportedly helped obscure activity and supplied the campaign's name. The source does not provide exploit requests, credential-exfiltration destinations, or precise persistence artifacts.^[0]

The reported scale requires qualification. The article calls 46 instances real-world victims, but states that the count came from unauthenticated instances matching honeypot conditions; it does not present individual compromise evidence for all 46. Researchers estimated that at least half remained Internet-visible, suggesting at least 20 organizations were still exposed. These figures and the campaign findings come from a single supplied report relaying Era Security's research, rather than independent corroboration.^[0]

Defensive priorities are to remediate exposed vulnerable Flowise deployments while separately addressing network access, cloud identity, and data protection. Researchers specifically recommend monitoring enumeration activity and retaining application logs away from the affected workload. Attribution remains unresolved: reported Chinese characters were explicitly acknowledged as potentially deceptive and do not establish a national affiliation.^[0]

Attack chain

1. 1. Post-entry environment and privilege discovery: Researchers described attackers mapping the environment and available privileges after gaining access. The article places exposed, vulnerable Flowise deployments at the center of the investigation but does not supply the initial exploit request or enough detail to reconstruct the entry sequence.^[0]
2. 2. Credential hunting: Following environment and privilege mapping, attackers reportedly searched for credentials. The researchers identified cloud-credential acquisition as an objective, but the article does not name searched files, secret stores, or credential-exfiltration destinations.^[0]
3. 3. Cloud metadata-service abuse and access escalation: The reported sequence then involved exploiting cloud metadata services across multiple providers to escalate access. The source does not identify provider-specific requests, metadata protections bypassed, or the permissions obtained.^[0]
4. 4. Persistence: Researchers reported that attackers subsequently established persistence. Separately, they observed log concealment involving seemingly benign, fleeting 'hello' messages; the article does not establish where that concealment occurred within the sequence. Lateral movement was described as an objective, not demonstrated as a completed phase in every affected environment.^[0]

Disclosure timeline

How it works

The report identifies CVE-2024-58351 as a critical code-injection vulnerability affecting the unpatched Flowise deployments found during scanning. It does not describe the injection point, malicious input format, authentication requirements for exploitation, execution context, or underlying code defect. The evidence therefore supports identifying the reported weakness but not reconstructing a working exploit or a precise vulnerability-to-execution path.^[0]

The more concrete technical description concerns post-compromise activity: attackers enumerated privileges and the environment, hunted credentials, abused cloud metadata services to escalate access, and established persistence. The report describes this as a repeatable methodology spanning multiple cloud providers, but provides no provider-specific metadata requests or persistence mechanism.^[0]

Affected versions and patch status

Key takeaways

• Greeter's defining feature is the reported post-compromise progression from an AI application environment toward cloud credentials, elevated access, and persistence—not merely the presence of a vulnerable Flowise deployment.^[0]
• Keep exposure and compromise counts distinct. The reported 46-victim figure was derived from unauthenticated instances matching honeypot conditions, and the supplied article does not demonstrate compromise of every counted instance.^[0]
• The supplied evidence supports neither a named-actor profile nor a concrete attacker-infrastructure indicator set. It provides no actionable attacker IPs, domains, hashes, or persistence paths; the generic 'hello' message is described as camouflage and is not sufficient on its own as a high-confidence compromise indicator.^[0]
• Do not convert attribution suggestions into findings. Chinese characters were reportedly present, but the researchers acknowledged a possible false flag and did not establish an actor identity.^[0]
• Patching remains necessary, but the report's incident-specific defensive lesson is to combine it with exposure reduction, enumeration detection, cloud-identity protection, and separately retained logs.^[0]

Defensive actions

• Identify Internet-exposed Flowise deployments and prioritize remediation of those reported as vulnerable to CVE-2024-58351.: The researchers found a high proportion of unpatched deployments in their scan, and vulnerable Flowise infrastructure was central to the Greeter investigation. The supplied report does not identify a fixed version, so it cannot serve as a precise upgrade specification.^[0]
• Review unauthenticated Internet access to Flowise and associated data services, including exposed DynamoDB instances.: The investigation began with DynamoDB instances where unauthenticated users could download or delete data, then led to connected Flowise deployments. Researchers also found unauthenticated instances matching their honeypot conditions and emphasized network access control as a separate defensive layer.^[0]
• Prioritize detection of environment enumeration, privilege mapping, and credential-discovery activity in cloud and AI workloads.: These behaviors appeared in the reported post-compromise sequence. The researchers specifically advised monitoring enumeration activity to detect this class of attack earlier, rather than relying only on vulnerability discovery.^[0]
• Enable application and chat-tool logging when deploying these services, and stream the logs to a separate location.: The researchers recommend remote log retention so that deletion of a workload's local history does not eliminate the retained record. This is particularly relevant to a campaign reported to obscure its activity through benign-looking log messages.^[0]
• Treat cloud identity and credential protection as controls independent of the Flowise patch.: The reported objective was to obtain cloud credentials and enable lateral movement, while metadata-service abuse was used to escalate access. The researchers consequently emphasized layered network, data, and identity security rather than treating remediation of one application flaw as sufficient.^[0]
• Extend monitoring and exposure review across regions and accounts, prioritizing environments containing critical applications or sensitive assets.: Greeter activity was reportedly deployed across several AWS regions at once. The researchers also stressed closer monitoring of critical environments and noted that organizations may operate dozens or hundreds of cloud accounts.^[0]