Detecting SANDWORM_MODE: Defending AI Pipelines from JupyterHub Exploitation

CrowdStrike's recent reporting on "SANDWORM_MODE" exposes a critical shift in threat actor motivations: the weaponization of AI development environments. As we progress through 2026, organizations building Large Language Models (LLMs) and managing sensitive training data are squarely in the crosshairs of nation-state groups. This is not merely intellectual property theft; it is a campaign of infrastructure subversion. The attackers are exploiting the trust inherent in open-source AI toolchains and the collaborative nature of data science platforms like JupyterHub to gain a foothold. Defenders must move beyond traditional endpoint protection and implement specific telemetry for their R&D clusters.

Technical Analysis

The SANDWORM_MODE campaign demonstrates a sophisticated understanding of how modern AI teams work. The attack vector focuses on two primary areas of compromise:

JupyterHub Exploitation: JupyterHub, the multi-user server for Jupyter Notebooks, is a prime target due to its widespread use in data science and often permissive network configurations. Attackers are leveraging logic flaws in the service to achieve Remote Code Execution (RCE). Once exploited, the web interface—typically running as a high-privilege service—is used to spawn interactive shells, effectively giving the attacker direct control over the underlying host.
AI Supply Chain Compromise: The campaign utilizes a secondary vector involving the poisoning of Python packages. By uploading malicious packages to public repositories (PyPI) or compromising private repositories, attackers ensure that data scientists running standard pip install commands inadvertently pull down trojanized dependencies. These packages contain obfuscated code executed during the installation phase, establishing persistence and beaconing out to command-and-control (C2) infrastructure.

Affected Products & Platforms:

JupyterHub: All versions lacking strict input validation and RBAC enforcement.
Python Environments: Any Linux or Windows host utilizing pip for dependency management.

Exploitation Status: Confirmed active exploitation in the wild. CrowdStrike has observed this activity targeting high-value technology sectors and research institutions.

Detection & Response

Defending against SANDWORM_MODE requires visibility into the process lineage of development tools and the network behavior of build servers. Standard anti-virus often misses these attacks because the execution flow (e.g., a web server spawning a shell) is "allowed" in dev environments.

Sigma Rules

YAML

---
title: JupyterHub Spawning System Shell
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects JupyterHub or Jupyter Notebook server spawning a suspicious shell process (bash/sh/powershell), indicative of RCE.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/python3'
      - '/jupyterhub-singleuser'
    ParentCommandLine|contains:
      - 'jupyter'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  condition: all of selection_*
falsepositives:
  - Legitimate data science debugging sessions
level: high
---
title: Suspicious PyPI Package Installation via Pip
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects the installation of Python packages using pip that immediately spawn network connections, common in malicious supply chain packages.
references:
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_pip:
    Image|endswith:
      - '/pip'
      - '/pip3'
    CommandLine|contains: 'install'
  selection_net:
    CommandLine|contains:
      - 'setup.py'
      - 'post_install'
  condition: selection_pip and selection_net
falsepositives:
  - Legitimate package builds requiring network resources
level: medium
---
title: Outbound C2 from JupyterHub Process
id: c3d4e5f6-7890-12bc-def0-345678901cde
status: experimental
description: Detects the JupyterHub main process establishing outbound network connections to non-private IPs, suggesting reverse shell activity.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/node'
    Initiated: 'true'
    DestinationIp|isnotprivate: 'true'
  filter:
    DestinationPort: 8000
  condition: selection and not filter
falsepositives:
  - Legitimate webhook integrations
level: high

KQL Hunt (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious shell processes spawned by Jupyter services
let TimeRange = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeRange)
| where ProcessCommandLine has_any ("jupyter", "notebook") 
| where InitiatingProcessFileName in~ ("node", "python", "python3")
| where FileName in~ ("bash", "sh", "zsh", "pwsh")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Velociraptor VQL Hunt

VQL — Velociraptor

-- Hunt for JupyterHub configuration modifications and recent Python package installs
SELECT 
  FullPath, 
  Mtime, 
  Size, 
  Mode
FROM glob(globs='/root/.jupyter/**/*', accessor='auto')
WHERE Mtime > now() - 24h
UNION ALL
SELECT 
  FullPath, 
  Mtime, 
  Size
FROM glob(globs='/usr/local/lib/python*/dist-packages/*/', accessor='auto')
WHERE Mtime > now() - 24h
-- Limit to site-packages to catch newly installed libraries

Remediation Script (Bash)

Bash / Shell

#!/bin/bash
# Remediation Script: Audit JupyterHub and Python Environment
# This script checks for recent suspicious modifications and advises on hardening.

echo "[+] Auditing JupyterHub processes..."
ps aux | grep -E '[j]upyterhub|[j]upyter-notebook' | grep -v grep

echo "[+] Checking for recently modified Python packages (last 24h)..."
find /usr/local/lib/python*/dist-packages -maxdepth 1 -type d -mtime -1
find ~/.local/lib/python*/site-packages -maxdepth 1 -type d -mtime -1

echo "[+] Checking JupyterHub configuration for authentication bypasses..."
if [ -f /etc/jupyterhub/jupyterhub_config.py ]; then
  grep -E "(allow_root|admin_access|token)" /etc/jupyterhub/jupyterhub_config.py
fi

echo "[+] Recommendation: Ensure JupyterHub is updated to the latest version and restrict 'pip install' to private repositories only."

Remediation

Immediate action is required to secure AI development pipelines against this campaign.

Patch and Upgrade: Ensure JupyterHub is updated to the latest stable version. If specific patches are released in response to this advisory, apply them immediately.
Network Segmentation: Isolate JupyterHub instances and training environments from the general corporate network. Restrict outbound internet access from build servers to only necessary endpoints (e.g., approved PyPI mirrors).
Dependency Management: Enforce the use of private package repositories (e.g., Sonatype Nexus, JFrog Artifactory) and require code review for all internal packages. Block direct access to public PyPI from production build servers.
Access Control: Implement strict Role-Based Access Control (RBAC) for JupyterHub. Ensure that services do not run as root and that multi-user isolation is strictly enforced.
Audit Logs: Enable and forward JupyterHub access logs to your SIEM. Monitor for failed login attempts and unusual notebook execution patterns.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub