Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

US critical infrastructure monitor

Kernel (kernel.sh)

Cloud, identity and critical software · National

Monitoring
Not directly monitored. Shown from research findings only.
Public findings
1
Provider status posts on record
0

Cyber and operational findings

Analyst-reviewed records. The grade states how well the cause is established; event, first public observation and acknowledgement are separate dates.

A ConfirmedStatus: recovered

Compromised API key revoked 2 Nov 22:30Z. Second wave 3 Nov 05:41 to 07:17Z (cryptominer on servers); all hosting-provider API keys rotated 07:37Z; servers taken offline 07:46Z and 09:29Z; containment ended 22:50Z.

Event: Oct 24 21:18 UTC
First public: Nov 2 19:28 UTC
Third-party report: unknown
Acknowledged: Nov 4
  1. Oct 24 21:18 UTC · DET
    Initial access 24 Oct 21:18Z via leaked API key; detected 2 Nov 19:28Z only through a customer escalation (about 9 days dwell); incident declared 22:20Z.
    Source
  2. Nov 2 22:30 UTC · CON
    Compromised API key revoked 2 Nov 22:30Z. Second wave 3 Nov 05:41 to 07:17Z (cryptominer on servers); all hosting-provider API keys rotated 07:37Z; servers taken offline 07:46Z and 09:29Z; containment ended 22:50Z.
    Source
  3. Nov 3 11:27 UTC · REM
    Server-1 image cloned to secure storage 3 Nov 11:27Z; IPs blocked; access audit. Kernel believes actor is financially motivated and used ARTEX as command center.
    Source
  4. Nov 3 22:50 UTC · DIS
    Affected customers notified 3 Nov 22:50Z; public notice 4 Nov.
    Source

Provider status posts

Collected from the organisation's own public status page. These are its words; DFX adds only the wording classification.

No status posts collected for this organisation.