Human Operator Pivots Marimo RCE to AWS Bastion in Eight Seconds via Hand-Rolled Python

Sysdig telemetry captured the full chain: WebSocket connection at 18:57:22 from 172.236.12[.]17, credential lookup at 18:57:26, and SSH auth at 18:57:30. The operator issued over 850 commands across nine hours without public tooling or AI agents, evading traps that caught every profiled agentic threat actor. No recognizable frameworks appeared; all scripts were debugged live against the target environment.

The same Marimo instance exposed an asyncssh listener back to attacker infrastructure. This pattern matches prior cloud-native pivots where initial RCE yields IAM role credentials that directly unlock bastion hosts. Hunt.io's concurrent Redis campaign shows similar broad scanning followed by credentialed lateral movement, though via SLAVEOF and AOF injection rather than interactive shells.

Official statements emphasize AI speed while downplaying that manual tradecraft still bypasses the detection signatures built for agentic activity. The eight-second timeline was achieved without automation loops, indicating defenders relying on behavioral baselines for scripted attacks will miss high-skill operators.

Next observed activity will likely include additional bastion hops or Secrets Manager enumeration on the same AWS account within 48 hours if the operator maintains the session.