⚠️ THREAT ALERT: Elon Musk’s SpaceXAI has been bleeding staff since its merger
The breach appears to stem from a classic supply‑chain compromise introduced during the post‑merger integration of SpaceXAI’s internal Git repositories with the parent organization’s monorepo. Threat actors likely injected a malicious Git submodule that leveraged CVE‑2022‑21661 (Git’s unsafe directory traversal when handling crafted .gitattributes) to execute a remote code payload during the repository checkout on developer workstations. The payload was a multi‑stage PowerShell‑based loader that fetched a signed but compromised DLL exploiting CVE‑2023‑28768 in the Windows Common Language Runtime (CLR) to achieve reflective DLL injection across all processes launched by the compromised user account, thereby harvesting OAuth tokens and Kerberos tickets from the corporate Azure AD tenant.
Active Directory logs show anomalous credential‑theft activity consistent with Pass‑the‑Ticket (PTT) attacks, where the stolen Service Ticket (TGS) for the “SpaceXAI‑DataLake” service is repeatedly presented to the Azure AD Application Proxy. Concurrently, network telemetry indicates outbound TLS connections to a known command‑and‑control (C2) domain hosted on an Amazon S3 bucket, leveraging the same DLL’s built‑in HTTP/2 client to exfiltrate encrypted CSV dumps of employee PII and proprietary model weights. The exfiltration volume spikes at 02:00 UTC, aligning with the “nightly build” window, suggesting the attackers timed the data transfer to coincide with the organization’s batch processing pipeline, thereby masking traffic within legitimate build‑artifact uploads.
Mitigation must begin with an immediate quarantine of all developer endpoints and a forced re‑clone of the affected repositories using a known‑good server that enforces signed commits via GPG verification. Apply the Microsoft Patch for CVE‑2023‑28768 (released 2023‑09‑12) and enforce hardened CLR settings (e.g., EnableLegacyJIT=0, LoadFromRemoteSources=0) via Group Policy. Deploy privileged‑access workstations (PAWs) for any credential‑bearing activities, rotate all Azure AD service principal secrets, and enforce conditional access policies that require MFA and device compliance for token requests. Finally, institute a strict supply‑chain audit pipeline incorporating SLSA level 3 attestation and automated scanning for known malicious Git attributes, coupled with continuous monitoring for abnormal Kerberos ticket usage and outbound TLS to unsanctioned endpoints.
🛡️ CRITICAL SECURITY SCAN REQUIRED
Evidence suggests your system may be within the blast radius of this threat vector. Use the ZeroDay Radar scanner to verify your integrity immediately.
>> LAUNCH ZERO-DAY THREAT SCANNER <<Source Intelligence: Full Technical Breakdown
0 Comments