# The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

Compromised GitHub token cloned 18 private repos, leaking svc_automation AWS keys used to pivot across accounts, RCE a production DC, and exfiltrate SQL/billing data.

- Payout: Real-world hack
- Severity: critical
- Program: Wiz customer
- Analysis by: Wiz Research
- Disclosed: 2026-09-29
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/blue-agent-data-exfiltration-investigation
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-blue-agent-data-exfiltration-investigation
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:aws tech:github-actions tech:s3 technique:chained technique:recon vuln:access-control vuln:rce vuln:secrets-leak

**Target:** GitHub private repositories, AWS IAM service account, SSM-managed EC2 domain controller, S3
**Root cause:** Hardcoded AWS access keys (svc_automation AKIA) and DB connection strings stored in private GitHub repositories; a compromised GitHub token allowed cloning them, and the over-privileged CI service account could AssumeRole to admin and SSM SendCommand to production hosts.
**Steps:**
1. Attacker uses compromised GitHub token from Zenlayer VPN IP to clone 18 private repositories containing hardcoded credentials.
2. Extract svc_automation AKIA access key from cloned repo contents.
3. Authenticate to AWS via aws-cli on Kali Linux from Zenlayer IP; `AssumeRole` to CI role.
4. Pivot to second AWS account with different permanent key, `AssumeRole` to same CI role, then `SSM SendCommand` targeting `PROD-*******-DC1` production domain controller.
5. Upload exfil scripts to S3: `/ops-tools/mssql_table_export.py`, `/ops-tools/pg_table_export.py`, `/ops-tools/billing_export2.py`.
6. Compromised EC2 instances curl and execute staged scripts to extract SQL, PostgreSQL, and billing data.
**How found:** Blue Agent triaged simultaneous detections (third-party VPN, unusual country, offensive tool API calls) on svc_automation; noted non-human CI account, kali-amd64 UA, Zenlayer VPN IP; 30-day baseline showed only Amazon IPs with TeamCity/aws-sdk-go, so detection-window aws-cli AssumeRole(admin)/SendCommand was anomalous; tenant-wide ASO query found second svc_automation account; data-plane S3 PutObject query surfaced exfil scripts; cross-account IP pivot identified GitHub actor and audit logs showed 18 repo clones hours earlier.
**Exploitation:** Compromised GitHub token cloned private repos to harvest hardcoded AWS keys; stolen svc_automation credentials used from Kali Linux to AssumeRole into CI roles across two accounts, SSM SendCommand gave RCE on a production domain controller, custom Python scripts staged in S3 were fetched via curl by compromised EC2 instances to dump MSSQL, PostgreSQL and billing data.
**Escalation:** Single GitHub token compromise chained into cross-account AWS lateral movement, RCE on a production domain controller, and staged data exfiltration tooling.
**Insight:** Pivot from cloud management-plane anomalies to the data plane (S3 PutObject Path fields) to catch staged tooling, and correlate the attacker IP/ASO tenant-wide across AWS accounts and GitHub audit logs to find the initial-access repo clone that precedes the cloud activity.