Researchers uncover cloud attack chain targeting Flowise deployments

Researchers from Era Security have revealed a broad, multi-stage cloud attack chain dubbed “Greeter”, which began as a Shodan-led discovery of exposed Flowise deployments and quickly evolved into a sophisticated AI infrastructure intrusion. The campaign escalates beyond a simple exploit: attackers map privileges, hunt for credentials, and abuse cloud metadata services across multiple providers to ascend within environments, before establishing persistence. They also masked activity by dropping fleeting, benign-looking “hello” messages in logs to hinder detection.

The findings centre on Flowise, an open source GenAI development platform, with roughly 90% of nearly 3,000 observed deployments running unpatched versions vulnerable to the critical code injection CVE-2024-58351. Era Security deployed AI-powered honeypots on AWS to observe the techniques in action.

The campaign was deployed across several AWS regions simultaneously, with Era Security reporting 46 real-world victims so far, and estimating at least 20 organisations remain exposed because those unauthenticated instances are still internet-facing. While attribution remains uncertain, researchers note potential Chinese characters in code as inconclusive; a nation-state origin would be plausible given the orchestration level observed.

The study emphasises that defending this threat requires more than patching a single CVE. Defence-in-depth is urged, including keeping logs in a separate cloud location, monitoring for enumeration activity, and adopting layered security that covers network access, data protection, and identity safeguards to detect and disrupt such campaigns at multiple stages.