Northflank Security Breach: AI API Key Abuse — Detection and Remediation Guide for Cloud-Hosted Secrets

---
title: Suspicious Access to Environment Variable Files Containing API Keys
id: 8c1f4a72-3b6e-4d9f-a2c5-7e8b9d0f1a2b
status: experimental
description: Detects processes reading environment files, .env files, or secrets configuration that may contain API keys. Focused on non-standard processes accessing these files, which may indicate secrets harvesting after initial compromise.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection_target:
    TargetFilename|contains:
      - '.env'
      - 'secrets.yaml'
      - 'secrets.yml'
      - 'credentials.json'
      - '.api_keys'
      - 'vault-token'
  selection_target_2:
    TargetFilename|endswith:
      - '.env'
      - '.env.local'
      - '.env.production'
  filter_known_processes:
    Image|endswith:
      - '/node'
      - '/python'
      - '/python3'
      - '/java'
      - '/ruby'
      - '/nginx'
      - '/apache2'
      - '/gunicorn'
      - '/uwsgi'
      - '/supervisord'
  condition: (selection_target or selection_target_2) and not filter_known_processes
falsepositives:
  - Application runtimes legitimately loading environment configuration
  - DevOps tooling reading secrets during deployment
  - Container orchestrators injecting environment variables
level: medium
---
title: Outbound Connection to AI API Endpoint from Non-Standard Process
id: 2d5e8f14-6a3b-4c7e-b1d9-3f5a7c9e0b2d
status: experimental
description: Detects network connections to known AI API endpoints (OpenAI, Anthropic, Google AI) from processes that do not typically make such connections. May indicate stolen API key usage or unauthorized AI service access.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection_destination:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.cohere.ai'
      - 'api.mistral.ai'
  filter_known_apps:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\Code.exe'
      - '\cursor.exe'
  condition: selection_destination and not filter_known_apps
falsepositives:
  - Custom applications with legitimate AI integrations
  - AI-powered development tools and IDEs
  - Browser-based AI assistants
level: medium

// Hunt 1: Outbound connections to AI API endpoints from unexpected processes
// Useful for detecting unauthorized API key usage from compromised hosts
let AIEndpoints = dynamic([
    "api.openai.com",
    "api.anthropic.com",
    "generativelanguage.googleapis.com",
    "api.cohere.ai",
    "api.mistral.ai"
]);
let KnownAIProcesses = dynamic([
    "python", "python3", "node", "java", "ruby",
    "code", "cursor", "chrome", "firefox", "msedge"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl in~ (AIEndpoints)
| extend ProcessName = tolower(split(InitiatingProcessFileName, ".")[0])
| where ProcessName !in~ (KnownAIProcesses)
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort,
    InitiatingProcessAccountName
| sort by TimeGenerated desc;

// Hunt 2: Processes accessing .env or secrets files on Linux (via Syslog)
// Detects potential secrets harvesting activity
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any (".env", "secrets.yaml", "credentials.json", "api_key")
| where SyslogMessage has_any ("cat ", "less ", "more ", "head ", "tail ", "grep ", "find ", "curl ", "wget ", "base64")
| where ProcessName !in~ ("node", "python", "python3", "java", "supervisord", "systemd")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

// Hunt 3: Bulk environment variable enumeration (potential secrets discovery)
// Detects commands commonly used to dump environment variables from running processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (
    "cat /proc/*/environ",
    "printenv",
    "env |",
    "set |",
    "/proc/self/environ",
    "strings /proc"
)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessAccountName
| sort by TimeGenerated desc

-- Hunt for processes accessing .env files and enumerating process environments
-- Targets secrets harvesting behavior following initial compromise

-- Check for recently accessed or modified .env files
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
    '/home/*/**/.env',
    '/home/*/**/.env.local',
    '/home/*/**/.env.production',
    '/var/www/**/.env',
    '/opt/*/.env',
    '/srv/*/.env',
    '/root/.env'
])
WHERE Mtime > now() - 604800

-- Check for processes with environment-related command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(printenv|cat.*env|/proc/.*environ|env\s*\|)'
   OR CommandLine =~ '(?i)(api.key|secret|token|credential)'

-- Check for active network connections to known AI API endpoints
SELECT Pid, Name, Path, Address, Port, Status
FROM netstat()
WHERE Address =~ '(?i)(openai|anthropic|googleapis|cohere|mistral)'
   OR Port = 443 AND Status = 'ESTABLISHED'

#!/bin/bash
# Northflank Breach Response — Secrets Audit and Rotation Verification
# Run this on hosts that store secrets to identify exposed credentials
# Date: 2026-04-06

set -euo pipefail

echo "=========================================="
echo " Secrets Audit — Northflank Breach Response"
eecho "=========================================="
echo ""

# --- Step 1: Find all .env and secrets files ---
echo "[*] Scanning for environment and secrets files..."
ENV_FILES=$(find /home /var/www /opt /srv /root /etc \
    -maxdepth 6 \
    \( -name ".env" -o -name ".env.local" -o -name ".env.production" \
       -o -name "secrets.yaml" -o -name "secrets.yml" \
       -o -name "credentials.json" -o -name ".api_keys" \) \
    2>/dev/null || true)

if [ -z "$ENV_FILES" ]; then
    echo "[+] No .env or secrets files found."
else
    echo "[!] Found the following secrets files:"
    echo "$ENV_FILES" | while read -r f; do
        echo "    - $f (modified: $(stat -c '%y' "$f" 2>/dev/null || echo 'unknown'))"
    done
fi

# --- Step 2: Identify AI API keys in environment files ---
echo ""
echo "[*] Checking for AI API key patterns in found files..."
AI_KEY_PATTERNS=(
    "sk-ant"         # Anthropic
    "sk-proj"        # OpenAI project keys
    "sk-"             # OpenAI legacy keys (broader match)
    "AIza"           # Google AI / GCP API keys
    "sk_live"        # Stripe (often co-located)
)

for pattern in "${AI_KEY_PATTERNS[@]}"; do
    MATCHES=$(echo "$ENV_FILES" | xargs grep -l "$pattern" 2>/dev/null || true)
    if [ -n "$MATCHES" ]; then
        echo "[!] POTENTIAL API KEY found (pattern: $pattern) in:"
        echo "$MATCHES" | while read -r m; do
            echo "    - $m"
        done
    fi
done

# --- Step 3: Check environment variables of running processes ---
echo ""
echo "[*] Checking running processes for exposed AI API keys..."
for pid in $(ls /proc/ | grep -E '^[0-9]+$'); do
    if [ -r "/proc/$pid/environ" ]; then
        if strings "/proc/$pid/environ" 2>/dev/null | grep -qE '(sk-ant|sk-proj|sk-[a-zA-Z0-9]{20,}|AIza)'; then
            PROC_NAME=$(cat "/proc/$pid/comm" 2>/dev/null || echo "unknown")
            echo "[!] Process $pid ($PROC_NAME) has AI API keys in environment"
        fi
    fi
done

# --- Step 4: Check shell history for key exposure ---
echo ""
echo "[*] Checking shell histories for exposed API keys..."
find /home /root -name ".bash_history" -o -name ".zsh_history" 2>/dev/null | while read -r hist; do
    if grep -qE '(sk-ant|sk-proj|sk-[a-zA-Z0-9]{20,}|AIza)' "$hist" 2>/dev/null; then
        echo "[!] API key pattern found in shell history: $hist"
    fi
done

# --- Step 5: Check for recent outbound connections to AI APIs ---
echo ""
echo "[*] Checking recent connections to AI API endpoints..."
AI_DOMAINS="api.openai.com|api.anthropic.com|generativelanguage.googleapis.com|api.cohere.ai|api.mistral.ai"
if command -v ss &>/dev/null; then
    ss -tnp 2>/dev/null | grep -E "$AI_DOMAINS" || echo "[+] No active connections to AI API endpoints detected."
fi

echo ""
echo "=========================================="
echo " NEXT STEPS:"
echo " 1. Rotate ALL secrets stored on Northflank immediately"
echo " 2. Revoke and regenerate AI API keys at each provider console"
echo " 3. Review API usage logs at each AI provider for anomalies"
echo " 4. Check billing dashboards for unexpected usage spikes"
echo " 5. Audit database access logs if connection strings were exposed"
echo " 6. Move secrets to a dedicated secrets manager (Vault, AWS SM)"
echo "=========================================="