From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

June 26, 2026 · Fortinet Threat Research · Severity: MEDIUM

A recent cybersecurity incident involving the Shai Hulud threat actor group exploited vulnerabilities in CI/CD pipelines to gain unauthorized access to cloud infrastructure, culminating in a breach of Amazon Redshift. The attack began with the compromise of Jenkins, a widely used CI/CD tool, where Shai Hulud harvested credentials stored in Jenkins configurations. These credentials were then used to escalate privileges within AWS environments, allowing the attackers to access sensitive data stored in Amazon Redshift. Fortinet's Cloud Native Application Protection Platform (FortiCNAPP) detected and analyzed the breach, highlighting the group's persistence and sophisticated tactics. The breach primarily affects organizations using Jenkins for CI/CD processes and AWS for cloud infrastructure, particularly those leveraging Amazon Redshift for data warehousing. The incident underscores the critical importance of securing CI/CD pipelines and cloud credentials, as attackers increasingly target these systems to move laterally and escalate access. While specific CVEs were not mentioned, the attack demonstrates how misconfigured or poorly secured CI/CD tools can serve as entry points for broader cloud compromises. This breach serves as a stark reminder for organizations to implement robust access controls, monitor for unusual activity, and secure sensitive credentials across their cloud and development environments.

See how Shai Hulud-linked CI/CD compromise exposed Jenkins credentials, enabled AWS escalation, and led to Redshift breach activity detected by FortiCNAPP