From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

June 26, 2026 · Fortinet Threat Research · Severity: MEDIUM

This Fortinet report details a Shai Hulud-linked attack that compromised CI/CD pipelines. It exposed Jenkins credentials, enabling AWS privilege escalation and a Redshift data breach. The activity was detected by FortiCNAPP, highlighting the need for cloud security monitoring.

See how Shai Hulud-linked CI/CD compromise exposed Jenkins credentials, enabled AWS escalation, and led to Redshift breach activity detected by FortiCNAPP