The Greeter Campaign: How Attackers Are Exploiting AI Workloads to Compromise Cloud Infrastructure at Scale
Executive Summary
Executive Summary In November 2026, Era Security researchers uncovered a sophisticated, multi-stage cloud infrastructure attack campaign dubbed 'Greeter,' named for the benign 'hello' messages attackers deliberately planted in logs to obscure their activity. Exploiting CVE-2024-58351, a critical code-injection flaw in Flowise—an open-source GenAI development platform—attackers scanned exposed Amazon DynamoDB instances via Shodan, then systematically mapped cloud privileges, harvested credentials, abused cloud metadata services across AWS regions, and established persistent lateral movement. With 46 confirmed real-world victims and an estimated 20 organizations still exposed, the campaign demonstrates a nation-state-caliber level of orchestration targeting AI workloads at scale.
Greeter represents a paradigm shift in cloud-native threats: attackers are now weaponizing AI infrastructure itself as an initial foothold, moving beyond traditional container escapes and Docker API exploits. The campaign's use of AI-assisted code writing, cross-region simultaneity, and log obfuscation signals that cloud and AI attack surfaces have matured into high-value, high-sophistication targets demanding defense-in-depth architectures rather than reactive patch management alone.
Why This Matters Now
Why This Matters NowRoughly 90% of nearly 3,000 scanned Flowise deployments remain unpatched against CVE-2024-58351 as of late 2026, while AI-powered attack orchestration has collapsed the window between vulnerability disclosure and mass exploitation to hours. Organizations racing to adopt GenAI platforms are inadvertently expanding their cloud attack surface faster than security controls can keep pace, making layered network segmentation, egress enforcement, and real-time anomaly detection immediately critical.
Attack Path Analysis
Attack Path AnalysisThe Greeter campaign began with automated Shodan-based reconnaissance targeting publicly exposed Flowise GenAI instances vulnerable to CVE-2024-58351, enabling unauthenticated code injection as the initial foothold. Attackers then systematically mapped IAM privileges and exploited cloud metadata services to escalate permissions, before pivoting laterally across multiple AWS regions using harvested service account credentials. Command and control was maintained through obfuscated log entries ('hello' messages) and AI-assisted orchestration, while cloud credentials were exfiltrated to attacker-controlled infrastructure. The campaign ultimately threatened persistent AI workload compromise and potential destruction of cloud-hosted data assets across at least 46 confirmed victim organizations.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers used automated Shodan scanning to identify publicly exposed, unpatched Flowise GenAI deployments (approximately 90% of ~3,000 scanned instances) running versions vulnerable to CVE-2024-58351, a critical unauthenticated code-injection flaw. Exploitation of this vulnerability provided direct remote code execution on cloud-hosted AI workloads without requiring credentials. Exposed Amazon DynamoDB instances were also discovered open to unauthenticated read and delete access.
Related CVEs
Related CVEsCVE-2024-31621
CVSS 7.6Flowise, an open-source low-code LLM application builder, contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to access restricted API endpoints, potentially leading to arbitrary code execution and full system compromise.
Affected Products:
FlowiseAI Flowise – < 1.6.6
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesExploit Public-Facing Application
Unsecured Credentials: Cloud Instance Metadata API
Cloud Infrastructure Discovery
Valid Accounts: Cloud Accounts
Impair Defenses: Disable or Modify Cloud Logs
Cloud Storage Object Discovery
Cloud Service Dashboard
Remote Services: Cloud Services
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Software Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Monitoring and Training — Monitoring of Authorized User Activity and Detection of Unauthorized Access
Control ID: Section 500.14
DORA (EU 2022/2554) – Protection and Prevention of Cloud Infrastructure Attacks
Control ID: Article 9 — ICT Security Policies and Procedures
CISA Zero Trust Maturity Model 2.0 – Least Privilege and Continuous Validation of Cloud Identities
Control ID: Identity Pillar — Pillar 1: Identity Access Management
NIS2 Directive (EU 2022/2555) – Vulnerability Management and Incident Detection for Cloud and AI Workloads
Control ID: Article 21 — Cybersecurity Risk Management Measures
ISO/IEC 27001:2022 – Timely Identification and Remediation of Technical Vulnerabilities in Cloud Environments
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Greeter campaign directly targets exposed cloud AI infrastructure; unpatched Flowise CVE-2024-58351 enables credential theft, lateral movement, and multi-region AWS exfiltration requiring Zero Trust segmentation and egress policy enforcement.
Financial Services
Cloud infrastructure attacks exploiting metadata services and service account escalation threaten PCI 4.0 and NIST.800-53 compliance, with credential exfiltration enabling unauthorized access to sensitive financial workloads and customer data.
Health Care / Life Sciences
AI workload compromise via unpatched GenAI platforms risks HIPAA violations across data-in-transit and access control requirements, as lateral movement through east-west cloud traffic exposes protected health information at scale.
Computer Software/Engineering
Open-source GenAI development platforms like Flowise represent critical attack surface; shadow AI, agentic workloads, and unpatched LLM toolchains enable persistent cloud-native compromise requiring CNSF inline enforcement and Kubernetes pod segmentation.
Sources
Sources- Attackers Say 'Hello' to a Different Scale of Cloud Attackhttps://www.darkreading.com/cloud-security/attackers-hello-scale-cloud-attackVerified
- NVD - CVE-2024-31621 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2024-31621Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- LLMjacking Emerges as Thriving Cybercriminal Enterprisehttps://www.darkreading.com/cloud-security/llmjacking-thriving-cybercriminal-enterpriseVerified
- FlowiseAI Security Advisories - GitHubhttps://github.com/FlowiseAI/Flowise/security/advisoriesVerified
- AWS Security Best Practices for Cloud Metadata Service Protectionhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.htmlVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
The Greeter campaign exploited publicly reachable GenAI workloads and abused cloud-native identity paths to traverse across AWS regions at scale, making Aviatrix Zero Trust CNSF directly relevant as a means of constraining attacker reachability and reducing the blast radius across segmented cloud environments. By enforcing workload-level isolation, restricting east-west traversal, and limiting outbound egress paths, Aviatrix CNSF would likely have meaningfully narrowed the attacker's ability to pivot freely across regions and exfiltrate harvested credentials.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Internet-facing exposure of the Flowise GenAI workloads and DynamoDB instances could likely have been reduced by enforcing perimeter-level segmentation policies that limit inbound reachability to only explicitly authorized sources, shrinking the attack surface available to opportunistic Shodan-based scanning.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely limit the scope of privilege escalation paths available from a compromised AI workload by constraining which internal services and cloud metadata endpoints that workload is permitted to reach, making it harder to harvest IMDS credentials or enumerate IAM roles freely.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely constrain the attacker's ability to traverse freely across AWS regions and reach unrelated workloads or data stores, reducing the blast radius of lateral movement even after initial credentials were harvested from a single compromised instance.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely surface anomalous outbound and intra-cloud communication patterns associated with attacker orchestration, and policy enforcement across cloud environments could reduce the range of channels available for sustaining command and control activity from compromised workloads.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement would likely reduce the available outbound paths from compromised workloads to attacker-controlled infrastructure, constraining the exfiltration of harvested IAM tokens and cloud credentials to only destinations explicitly permitted under egress policy.
Had prior CNSF controls been applied across segmentation, east-west, and egress stages, the confirmed blast radius across 46 victim organizations would likely have been reduced, as attacker movement between regions and services would have been constrained and credential exfiltration paths narrowed, limiting the scope of persistent footholds and downstream LLMjacking or data deletion activity.
Impact at a Glance
Affected Business Functions
- AI/LLM Workload Operations and GenAI Pipeline Availability
- Cloud Credential and Identity Access Management (IAM)
- Cloud Data Storage and DynamoDB Data Integrity
- Lateral Movement Surface Across Multi-Region AWS Environments
Estimated downtime: 14 days
Estimated loss: N/A
Cloud provider credentials (AWS IAM keys and service account tokens) harvested via metadata service exploitation, enabling lateral movement across organizational AWS environments. Amazon DynamoDB data stores were exposed unauthenticated, risking exfiltration or deletion of application data, AI training datasets, LLM pipeline configurations, and potentially sensitive customer or business records stored within those instances. Approximately 46 confirmed real-world victims identified, with at least 20 organizations estimated to remain actively exposed. The scale and multi-region deployment indicate broad credential harvesting across cloud-native and AI-driven organizations.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (CNSF/ZTMM.Network) to enforce identity-based, least-privilege microsegmentation around AI workloads and GenAI platforms like Flowise, ensuring that even a compromised pod or instance cannot freely access IAM metadata services or adjacent cloud resources without explicit policy authorization.
- • Deploy East-West Traffic Security controls to monitor and restrict workload-to-workload and service-to-service communication across cloud regions, blocking the multi-region lateral movement pattern observed in Greeter by requiring all inter-region flows to traverse inspected, policy-enforced paths.
- • Enable Multicloud Visibility and Control with centralized traffic observability and anomaly detection across all cloud accounts and regions to surface enumeration activity, repeated metadata service queries, and the obfuscated 'hello' log-noise patterns that made Greeter difficult to detect using traditional log review alone.
- • Enforce Egress Security and Policy with FQDN-based filtering and strict outbound traffic controls on all cloud workloads to block unauthorized credential exfiltration to attacker-controlled destinations, ensuring no AI workload or cloud instance can transmit harvested tokens or data to unknown external endpoints.
- • Activate Cloud Native Security Fabric (CNSF) inline enforcement with real-time inspection of AI agent and cloud control-plane interactions to detect prompt injection, shadow AI usage, and agentic AI abuse patterns, while ensuring Inline IPS (Suricata) signature coverage addresses known exploit patterns associated with CVE-2024-58351 class vulnerabilities at the network layer before workloads are reached.
