The Pulse
Kernel Believes Attackers Are Leveraging ARTEX in a Larger Cryptomining Campaign
Kernel says an unauthorized party accessed and downloaded data from its logging provider, which contained a small number of kernel API keys and app deployments’ third-party secrets. Kernel says its evidence suggests the attacker or attacker
AI.info Team · Written with AI · fact-checked ·
Kernel’s November 4 notice says it detected a data security incident on November 2. The company’s account traces the first activity to October 24, when an unauthorized party used a compromised KERNEL API key to probe for access. Three days later, Kernel says, the same party used the compromised key to gain access to a staff login to its logging provider and download data. That data contained a small number of kernel API keys and app deployments’ third-party secrets.
Kernel says the attacker used a compromised credential for its hosting provider account on November 3 to access four GPU-enabled servers. Three servers ran KERNEL browser sessions; the fourth contained no customer data. Kernel’s timeline records that a development server with no data was accessed at 05:41 UTC and that a cryptominer started there. The company says the same cryptominer was later attempted to start on server-3 and server-4.
Kernel’s timeline says an impacted-customer escalation came at 19:28 UTC on November 2. The company declared incident-1 at 22:20, found and revoked an API key ten minutes later, and escalated the incident’s severity to critical at 23:50. Kernel says it declared incident-2 with critical severity at 07:11 UTC on November 3 and established at 09:00 that incident-2 was the same actor as incident-1. The breach impacted 0.28% of Kernel’s customers.
Kernel Believes Attackers Are Leveraging ARTEX as a Command Center
Kernel says its evidence suggests the attacker or attackers are financially motivated and that this was a part of a larger cryptomining campaign. The company believes they are leveraging AI-assisted pentesting platform ARTEX as a command center to automate and amplify the impact of their campaign. Kernel says it has shared the known and confirmed threat intelligence from the incident with abuse teams at its hosting providers and logging infra vendor. It says it plans to share more with threat intelligence communities and is able to share the attacker’s technical fingerprint if needed.
Kernel Lists API-Key Controls and Detection Measures as Next Steps
Kernel says it revoked compromised credentials, removed the party’s access to its logging provider, blocked the IP addresses involved and took affected servers offline. It also rotated credentials those servers had access to, audited potential unauthorized access across all systems, and notified organizations whose data was exposed and provided guidance on remediation. The company says it employed its security incident response plan from November 2 to November 4 to identify, contain, eradicate and recover all affected systems.
Kernel’s product-security work includes increasing adoption of scoped API keys across its customers, improving network control for usage of API keys and improving API key rotation mechanisms. For detection and response, the company says it is bolstering its Security Information and Event Management (SIEM) with detection and threat intelligence from this specific threat actor and investing in dynamic blocking rules to target emerging and fast-moving threat actors. Kernel directs those seeking more details to support@kernel.sh.