Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
CI/CD pipeline abuse: the problem no one is watching
Threat Actors
Excerpt
Preamble In 2025 and 2026, we watched a pattern play out across the industry. Attackers stopped going after production servers directly and started targeting the automation that deploys to them. Compromised developer credentials, a modified workflow file, and suddenly every secret in a CI/CD environment is streaming to an attacker-controlled endpoint. We saw this play out across incidents involving major open-source projects , Fortune 500 companies , and critical…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-30066 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…