Preventing One of The Largest Supply-Chain Attacks in History

Preventing One of The Largest Supply-Chain Attacks in History

Speakers: Maksim Shudrak

Conference: DEF CON 33 (August 2025)

YouTube: https://www.youtube.com/watch?v=jraaS3lUP0I

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Maksim%20Shudrak%20-%20Edge%20of%20Tomorrow%20Foiling%20Large%20Supply%20Chain%20Attacks%20By%20Taking%205k%20Abandoned%20S3%20Buckets%20from%20Malware%20and%20Benign%20Software.pdf

Overview

Security researcher Maksim Shudrak delivered one of DEF CON 33's most concrete supply-chain attack analyses by doing something no prior researcher had done at scale: he actually claimed 5,155 abandoned AWS S3 buckets, logged who contacted them, and used LLM-assisted triage to identify hundreds of genuinely dangerous exposure scenarios. The talk spans from threat modeling through nine detailed case studies, concluding with practical remediation that cloud providers can implement to eliminate the risk structurally. The central finding is stark — a well-resourced attacker who spent the same effort would have had access to infrastructure touching 28,000 hosts across 158 countries and 25 government networks, potentially enabling a crypto-worm-scale incident.

Background

▶ Watch: Here uh before we start I need to say that I'm prese (2:39)

Supply-chain attacks invert the economics of targeted intrusion. Rather than hammering a hardened perimeter, an attacker compromises a dependency used by the target, trading precision for reach. The AWS S3 namespace makes this especially tractable: when a bucket is deleted — whether by its owner, by an abuse takedown, or as part of a malware cleanup — its name re-enters a shared, publicly claimable pool. Any code or data pipeline that continues pointing at the original name will, without modification, begin consuming whatever the new bucket owner serves.

The attack surface is not hypothetical. Security researchers, red teamers, and actual threat actors have exploited analogous patterns for years: backdoored PyPI packages that pull installation binaries from expired S3 URLs, npm packages referencing deleted buckets, Cobalt Strike beacons dialing back to recycled domains, and even a sovereign state TLD that was briefly reclaimable. Watchtower Research demonstrated the viability by claiming 150 such buckets in earlier work. Shudrak's contribution is to push that scale to 5,155 and to systematically measure actual impact rather than theorize about it.

Shudrak holds a PhD in computer security and conducts red teaming at BigID. He has presented at DEF CON twice previously and maintains open-source tools for phishing simulation, software analysis, and GCP scanning. This research was conducted independently.

Key Findings

▶ Watch: This is an example of a LO query to AWS. (13:14)

The research operated under strict rules of engagement: all claimed buckets returned HTTP 403 to callers (never serving actual content), testing was performed only against controlled clones, no individual IP addresses or organizations were attributed, and findings were responsibly disclosed to AWS prior to the talk.

Over a five-day logging period across the three source categories — GitHub references, Maven/PyPI packages, and active malware — the following traffic materialized:

| Source | Buckets Registered | Buckets with Traffic | Requests | Unique Hosts | Countries |

|--------|-------------------|----------------------|----------|--------------|-----------|

| PyPI & Maven | 480 | 255 | 4.5 million | 15,000 | 129 |

| Malware | 188 | 175 | 2 million | 20,000 | 142 |

| GitHub | 4,500 | 1,500 | ~4 million | 243,000 | All except North Korea |

Total: 26 GB of logs, approximately 11 million requests, and infrastructure reaching hosts in effectively every country on Earth. After LLM-assisted triage filtered out scanner bots and non-sensitive content (images, static text), roughly 500 buckets were classified as high sensitivity.

Verified impact across the sensitive subset: 28,000 users and hosts, 158 countries, 134 distinct organizations, and 25 government networks. Twenty-four nation-state and EU assets were within the exposure radius.

Technical Deep Dive

▶ Watch: me show how it uh works in practice. (19:52)

Bucket Discovery at Scale

Finding candidate buckets required different tooling for each corpus:

GitHub — Sourcegraph's code-search API allows querying petabytes of repository data in seconds. A targeted regex against s3.amazonaws.com references, combined with a bucket-name extraction pattern, produced a candidate list in seconds rather than months. Approximately 4,500 exploitable references were found this way.

Maven and PyPI — Package registries require enumerating and downloading packages individually, then extracting S3 references from the package contents in memory. Running this on a consumer machine for one and a half months covered roughly 40–45% of the total package corpus. The volume reflects the scope: millions of packages across both ecosystems.

Malware — The URLhaus database catalogues malware samples with associated infrastructure URLs, including S3 links used as second-stage payload delivery. This bypasses the need to analyze packed or obfuscated binary samples directly.

LLM-Assisted Triage

After claiming buckets and enabling access logging, the raw data was gigabytes of request logs per source category. Manual inspection was impractical. Shudrak built a three-agent LLM pipeline: a Planner agent with internet and GitHub search tools, an Aggregator, and a Classifier. The pipeline reduced the analysis window from months of manual work to days, identifying 500 sensitive buckets from the full set by classifying request targets into categories: executables, ML model files (pickle-format), archives, PyPI/Maven packages, dynamic web content, static sensitive files (PDFs, Office documents), and configuration files.

Case Studies

Case 1 — Windows Executables: Several GitHub projects referenced bucket-hosted binaries pulled via PowerShell install scripts. One network equipment vendor's installer silently fetched a setup binary from what had become an unclaimed bucket. Minecraft-Pi's asset pipeline executed code pulled directly from a bucket during installation. Vagrant box configurations shelled out to bucket-hosted VM images that, once modified, would execute arbitrary commands on the host.

Case 2 — ML Models (Pickle Deserialization): PyTorch's .pth model format uses Python's pickle module for serialization. Pickle deserialization is inherently arbitrary code execution — it executes whatever Python objects are embedded in the file. Two affected projects had significant GitHub traction (4,000 and 33,000 stars respectively). The demo showed a 34 MB poisoned model file that popped a calculator on load via os.system().

Case 3 — Maven and PyPI Packages: Nine high-sensitivity buckets were identified in this category. One package, Notoplex, pulled a pre-built binary from S3 during installation; the bucket reference was live and reclaimed. Exposure included five Fortune 500 companies spanning three of the world's largest banks, a major AV vendor, a global telecom provider, and a large retail chain. A second package, Kuvadev, was a Maven repository proxy with 288 distinct connecting hosts including five government entities in Europe and South America, a global investment fund, and two major technology/telecom companies.

Case 4 — Static Files and Social Engineering: Some buckets served PDFs and Microsoft Office documents. The attacker scenario here is document macro execution: a victim opens what they believe to be a trusted engineering calculator PDF and enables macros. Three state-level agencies in Europe and South America were among callers.

Case 5 — Malware Stage 2 (Linker): The Linker malware family, distributed as a malicious Chrome extension masquerading as a Flash playlist player, fetches JavaScript payloads from S3 on each page visit. Active three to four years prior to the research, its referrer logs revealed execution context on Gmail, Twitter, Instagram, Facebook, LinkedIn, and TikTok — the last of which explicitly allowed amazonaws.com in its Content Security Policy. Demo: a replaced JS payload exfiltrated cookies and page data to a controlled S3 bucket. Government sites in 30 countries appeared in the referrer logs.

Case 6 — Malware Stage 2 (RK Stealer): This four-year-old stealer posed as legitimate utilities (e.g., a Wireshark installer), pulling a second-stage executable over unencrypted HTTP from S3. The demo replaced the payload with a benign calculator binary to demonstrate blind execution. Old sandbox reports confirmed the original behavior.

Attacker Economics

Claiming 5,000+ buckets required no technical sophistication beyond running the discovery scripts. The operational cost was approximately $20 in log storage. The attack is viable for activists, financially-motivated criminals, and nation-state actors. For ransomware operators, the reach (243,000 hosts from GitHub references alone) would represent an extraordinary return on near-zero investment.

Demo / PoC

▶ Watch: on all of this uh resources for that for the attacker, right? (32:52)

The talk included live demonstrations of:

1. A poisoned PyTorch .pth model file (34 MB) triggering os.system('calc') on deserialization, demonstrating the arbitrary code execution vector via pickle.
2. The Linker malware replacement scenario, where a substitute JavaScript payload exfiltrated TikTok session cookies and page content via a researcher-controlled S3 bucket.
3. The RK Stealer stage-two replacement, where a netcat-served calculator executable ran silently on a victim machine that had been infected with the original first-stage dropper.

All demos used controlled environments and researcher-owned infrastructure. No actual malware was served to real victims.

Defensive Implications

▶ Watch: But I want to highlight that this is likely a tip of an iceberg here, right? (39:22)

For developers: Audit all build scripts, CI/CD pipelines, and package manifests for hardcoded S3 bucket references. Several open-source tools exist to scan codebases for dangling bucket references. Replace predictable, human-readable bucket names with machine-generated, unguessable identifiers. Avoid referencing third-party buckets directly; vendor artifacts locally.

For security teams: Treat any CI/CD step that fetches remote executables or model files as a potential injection point. Verify checksums or signatures on all downloaded artifacts before execution. Monitor for unexpected s3.amazonaws.com traffic originating from build systems or endpoint software.

For cloud providers: Shudrak's structural remediation proposals target the root cause. Project-scoped namespaces — where a bucket name is permanently bound to the project that created it and cannot be recycled — would eliminate the attack class entirely. AWS, following responsible disclosure, collaborated positively and raised the per-account bucket limit to 10,000, acknowledging the legitimate research use case. Non-recyclable naming is the more comprehensive fix.

For malware researchers: Buckets used as C2 or payload delivery should be treated like expired domains in Cobalt Strike beacon research — kept private rather than allowed to re-enter the public pool. Shudrak suggests a model analogous to Shadowserver's domain sinkholing: cloud providers or trusted researchers claim and silence these buckets rather than releasing them.

Key Takeaways

• Abandoned S3 bucket names are reclaimable by anyone. Any code that fetches from a deleted bucket will automatically consume whatever the new owner serves.
• At research scale (5,155 buckets, 5 days of logging), the exposure reached 28,000 hosts across 158 countries and 25 government networks.
• ML model files in pickle format are code execution vectors. Projects with thousands of GitHub stars were pulling models from reclaimed buckets.
• The attack cost is approximately $20 in cloud storage. Ransomware-grade reach is achievable with near-zero budget.
• LLM-assisted triage reduced months of log analysis to days, demonstrating that adversaries could automate the same at scale.
• Structural fixes — non-recyclable bucket namespaces — exist and can eliminate the risk class entirely.

About the Speaker

Maksim Shudrak is a security researcher and engineer at BigID, where he focuses on red teaming. He holds a PhD in computer security and has presented at DEF CON twice previously. He maintains open-source tools for phishing analysis, software vulnerability research, and GCP security scanning. This research was conducted independently of his employer.