> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Chinese actor hijacks Flowise GenAI honeypot for offensive analysis - URL: https://f4n6.co.uk/security-feed/chinese-actor-hijacks-flowise-genai-honeypot-for-offensive-analysis/ - Published: 2026-10-19T10:40:54.000Z - Updated: 2026-10-19T10:40:54.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary In late August 2026 a Sekoia Threat Detection & Research honeypot emulating an unauthenticated Flowise 2.2.8 instance recorded an intrusion that used legitimate Flowise features rather than a software vulnerability: the operator enumerated the REST API, harvested the simulated credential store, created a chatflow containing an HTTP Request node that beacons to attacker infrastructure, and then used the LLM agent as an offensive assistant against a real Nightingale (n9e) monitoring server and its Redis backend. The activity is assessed as a Chinese-speaking cybercriminal operator, with the prompts and Redis key naming pointing to an unregulated online gambling network operating across Hong Kong, Taiwan, Singapore, Brazil and Korea. No CVE is associated with this item and no CISA KEV entry applies; the exploitation path was configuration and exposure, not a patched flaw. EMEA financial services exposure is indirect but concrete: any internet-reachable Flowise, LangChain or comparable orchestration deployment that stores API keys or fronts a RAG pipeline presents the same credential-harvest and agent-abuse path, and the operator's demonstrated use of an LLM to generate target-specific exploitation guidance is a capability that transfers to any sector. Attribution to a tracked group is unconfirmed. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The intrusion ran against a honeypot simulating Flowise 2.2.8 with no authentication, a custom low-footprint emulation of the REST surface that returned JSON matching the real application and injected canary tokens into environment variables, fictitious admin flows and a simulated production PostgreSQL RAG backend. Sekoia describes the sequence as automated reconnaissance followed by manual interaction, with a human operator taking over once an exposed instance was identified. The confirmed steps, in Sekoia's phase numbering: 1. P1, discovery and first exfiltration (about 3 minutes, active enumeration under 2 minutes). The client fingerprinted the service with `GET /`, `GET /api/v1/ping`, `GET /api/v1/version` and `GET /api/v1/node-configs`, then listed flows and secrets with `GET /api/v1/chatflows` and `GET /api/v1/credentials`, and pulled a specific secret with `GET /credentials/{uuid}`. That last call returned the simulated OpenAI and Anthropic API keys and the database access details. 2. P2, dormancy of just over two hours. 3. P3, in-depth reconnaissance and inference probing. The tool scanned the API endpoints components, nodes, assistants, tools, document-store, vector-store, attachments, chat-messages, lead, apikey, marketplaces, users and variables, re-exfiltrated credentials, and tested inference with a trivial `"hi"` prediction across `/prediction/{id}`, `/chatflows/{id}` and `/chatflows/{id}/prediction`. 4. P4, chatflow manipulation. The operator sent a PUT/PATCH/POST sequence against `/chatflows/{id}` to rename an existing flow to "Customer Support v2" (verb fuzzing to find the accepted method), then created a new flow named "System Status" whose `flowData` contains an HTTP Request node with `"url": "http://154.217.251[.]226:19999/flowise-hb"` and method GET. The `flowise-hb` path (heartbeat) and port 19999 indicate an outbound callback: on execution the Flowise server beacons to attacker infrastructure, confirming code execution and giving a persistence and exfiltration channel. Sekoia classifies this as abuse of a legitimate outbound-HTTP feature, not server-side request forgery in the strict sense. 5. P5, LLM abuse. Across the three honeypot chatflows the operator ran jailbreak prompts. The first set posed as an "authorized security assessment" and "authorized audit" of an internal finance database at host 10.0.0.5, asking the agent to query the RAG store and summarise available financial records. After collecting the fake database endpoint from the instance, the operator adapted the prompts to that context, then asked the LLM to port scan the fake internal PostgreSQL IP. A later English prompt instructed the model to ignore its configured role, supplied two Redis keys (`n9e_meta_zl-hk-playz-prod-bizsys-gitlab-001`, `n9e_meta_aws-sbl-playz-98-prod-nginx-web-forward-001`) for a Nightingale server at a redacted IP, and asked what business `playz-prod` runs and what the highest-value lateral-movement targets would be, requesting the answer in Chinese. A second prompt, in Chinese, named Nightingale v6 at port 17000, stated CAPTCHA disabled, plaintext passwords and root/admin login, described the asset as the "playz-prod" 菠菜 (bōcài, gambling) platform cluster across AWS, Hong Kong and Taiwan, and asked for known unauthorised-access vulnerabilities, default credentials and specific API exploitation paths. 6. P6, periodic polling. Exfiltration requests every 10 minutes targeting the inventory of global variables and chatflows. The target was real. Shodan shows the IP named in the prompts exposes a Nightingale interface and an unsecured Redis server, and the exact Redis keys submitted to the honeypot are present in that Redis data, so the operator had probably identified the server beforehand through Shodan or an equivalent. The key set maps the infrastructure: `xjp` for Singapore, `hk`, `kr`, `tw` for Hong Kong, Korea and Taiwan, `zl` for Zenlayer, `aws` for the cloud segment, `98br` for the Brazil-facing playz platform, plus references to JumpServer and ZenTao. Sekoia's OSINT links the platform to the domains 98br\[.\]org and 98br\[.\]game, whose Android APK in sandbox analysis points to other casino applications including gr99\[.\]top and 11kk\[.\]co, the white-label pattern of one publisher distributing the same framework to many affiliates. Sekoia assesses with high confidence that the targeted monitoring server belongs to that infrastructure. The operator's telemetry came from 154.217.251\[.\]226, the same address used as the callback, with a minimal `Mozilla/5.0` User-Agent consistent with automated tooling. A 30-day search found no similar activity against Sekoia's other Flowise honeypots. The operator searched only for vulnerabilities affecting the Hong Kong and Taiwan environments despite keys referencing Brazil, Korea and Japan. Confidence caveats. The entire technical account rests on a single source, Sekoia's report, originally distributed as a private FLINT report on 7 September 2026; the endpoint sequence, callback address and prompt text are single-sourced and should be verified against your own telemetry before enforcement. The attribution to a Chinese-speaking cybercriminal operator is Sekoia's assessment, based on prompt language, the 菠菜 slang and the Pinyin key naming; it is not tied to any tracked group. Sekoia states the technical elements are insufficient for precise attribution, and the comparison to Earth Berberoka and Operation Dragon Castling is offered as victimology context, not a behavioural link. No MITRE ATT&CK profile exists for a named actor in this item, so treat attribution as unconfirmed. The report also notes that the honeypot cannot detect use of fake third-party tokens such as OpenAI API keys, so the true extent of credential abuse against the simulated secrets is unknown. ## 4\. Mitigation & containment P1, within 24 hours. - Inventory every Flowise, LangChain and comparable orchestration deployment reachable from the internet. For each, confirm whether authentication is enforced on `/api/v1/credentials`, `/credentials/{uuid}`, `/api/v1/chatflows` and `/api/v1/prediction`. Any instance answering those routes without authentication is the exposure this operator used; take it off the public internet or put it behind an authenticating reverse proxy. - Rotate every secret held in a Flowise credential store on any instance that was internet-facing without authentication: LLM provider keys (OpenAI, Anthropic, Google, Hugging Face), database connection strings and OAuth tokens. Treat them as disclosed. - Block outbound traffic from orchestration hosts to 154.217.251\[.\]226 and to TCP port 19999, and alert on any outbound request to a path matching `/flowise-hb`. - Search Flowise flow definitions for HTTP Request nodes whose URL points outside your approved egress list, and for flows named "System Status" or renamed to "Customer Support v2". P2, within 72 hours. - Restrict egress from orchestration platforms to an allowlist of LLM provider and internal service endpoints. The callback in this intrusion relied on unrestricted outbound HTTP from an agent node. - Review agent and tool permissions. Remove HTTP Request, custom script and web search nodes from flows that do not require them, and separate flows with network egress from those with RAG access to sensitive data stores. - Add prompt-injection and jailbreak detection in front of agent endpoints, alerting on prompts that assert authorization ("authorized security assessment", "authorized audit"), instruct the model to ignore its configured role, or ask the agent to scan, enumerate or summarise data outside its task. - Audit RAG-connected flows for the data they can reach. The operator's first objective was to have the agent query and summarise financial records; scope each flow's retrieval to the minimum data set its task needs. P3, within 7 days. - Patch Flowise to a current release. Sekoia names CVE-2025-59528 (CustomMCP remote code execution), CVE-2026-41264 (CSV Agent remote code execution) and CVE-2024-31621 (authentication bypass via case-sensitivity in the API path whitelist, fixed in 1.6.6) as the flaws this class of deployment carries. None was exploited in this intrusion, and no CVSS or KEV status is available for them in this advisory; verify each against the vendor advisory before scheduling. - Monitor the Nightingale (n9e) and Redis estate. If you run n9e, confirm Redis is not internet-reachable, that authentication is enabled, and that default or root/admin credentials are not in use; the operator's prompts specifically sought default credentials and unauthorised-access paths on n9e v6 at port 17000. - Add the operator's reconnaissance pattern to API gateway logging: a burst of GETs across `/api/v1/version`, `/api/v1/node-configs`, `/api/v1/credentials` and the full endpoint list within two minutes, followed by prediction calls with trivial input. ## 5\. Indicators of compromise | type | value | confidence | source | | ------ | ------------------------------------------- | ---------------------------------------- | ------ | | ipv4 | 154.217.251\[.\]226 | high (observed source and callback) | Sekoia | | url | hxxp://154.217.251\[.\]226:19999/flowise-hb | high (observed in created chatflow) | Sekoia | | domain | 98br\[.\]org | medium (OSINT link to targeted platform) | Sekoia | | domain | 98br\[.\]game | medium (OSINT link to targeted platform) | Sekoia | | domain | gr99\[.\]top | medium (referenced in 98br APK) | Sekoia | | domain | 11kk\[.\]co | medium (referenced in 98br APK) | Sekoia | No file hashes are given in the source. The Redis keys below are target-infrastructure identifiers, not attacker infrastructure, and are included because they are the strings the operator submitted and can be used to recognise the same targeting. ```iocs ipv4 154.217.251[.]226 url hxxp://154.217.251[.]226:19999/flowise-hb domain 98br[.]org domain 98br[.]game domain gr99[.]top domain 11kk[.]co string n9e_meta_zl-hk-playz-prod-bizsys-gitlab-001 string n9e_meta_aws-sbl-playz-98-prod-nginx-web-forward-001 ``` Behavioural indicators | behaviour | where to observe | confidence | | ----------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- | ---------- | | Burst of GETs to /api/v1/version, /api/v1/node-configs, /api/v1/chatflows, /api/v1/credentials and /credentials/{uuid} from one IP within two minutes | Flowise or reverse-proxy access logs | high | | Prediction calls with trivial input ("hi") across /prediction/{id}, /chatflows/{id} and /chatflows/{id}/prediction | Flowise API logs | high | | PUT/PATCH/POST sequence against /chatflows/{id} followed by creation of a flow containing an HTTP Request node to an external URL | Flowise audit or application logs | high | | Outbound GET to /flowise-hb on port 19999 | Egress firewall, proxy, EDR network telemetry | high | | Repeated requests every 10 minutes for global variables and chatflow inventory | Flowise API logs | high | | Prompts asserting authorization, instructing the model to ignore its role, or requesting port scans and data summaries | LLM gateway or prompt logging | high | | Minimal Mozilla/5.0 User-Agent on API requests | Web server logs | medium | ## 6\. Detection The source gives no file artefacts, so a file-based YARA rule would have nothing genuine to match. The usable material is network and API behaviour, which the Sigma rule below covers. ```yaml title: Flowise Credential Harvest and Agent Callback Abuse id: 8f3c2a71-4d6e-4b19-9a52-7c1e0d5b6f84 status: experimental description: Detects the Flowise API enumeration, credential harvesting and outbound HTTP Request node callback pattern reported by Sekoia in August 2026. author: Adverse Trace date: 2026-10-19 references: - https://www.sekoia.com/blog/a-honeypots-tale-deconstructing-an-attack-on-genai-infrastructure logsource: category: webserver detection: selection_recon: cs-method: 'GET' cs-uri-stem: - '/api/v1/version' - '/api/v1/node-configs' - '/api/v1/credentials' selection_secret: cs-method: 'GET' cs-uri-stem|startswith: '/credentials/' selection_flow_write: cs-method: - 'PUT' - 'PATCH' - 'POST' cs-uri-stem|startswith: '/api/v1/chatflows' selection_callback: cs-uri-stem|contains: '/flowise-hb' condition: selection_recon or selection_secret or selection_flow_write or selection_callback falsepositives: - Legitimate administrative use of the Flowise API from an approved management host - Health checks against /api/v1/version from monitoring level: high ``` Pair the rule with an egress alert on any outbound connection to 154.217.251\[.\]226 or to TCP 19999, and with a prompt-logging rule that flags requests containing "authorized security assessment", "authorized audit", "ignore your configured role" or requests to port scan or summarise financial records. ## 7\. Sources - Sekoia Threat Detection & Research, "A honeypot's tale: deconstructing an attack on GenAI infrastructure", https://www.sekoia.com/blog/a-honeypots-tale-deconstructing-an-attack-on-genai-infrastructure, published 2026-10-14 (originally a private FLINT report, 2026-09-07). ## 8\. Adverse Trace position No CVE is associated with this item and no CISA KEV entry applies, so there is no patch deadline to enforce; the severity here is exposure-driven, not vulnerability-driven. The intrusion succeeded because an orchestration platform was reachable without authentication and held live secrets, and the operator's later use of the agent as an offensive assistant against a real Nightingale and Redis estate shows the step from credential theft to third-party attack is short. For EMEA financial services the direct risk is limited to firms running internet-facing Flowise or similar agent platforms, but the technique, harvesting secrets and then steering the agent, applies to any RAG deployment holding customer or financial data. The technical account is single-sourced to Sekoia and the attribution to a Chinese-speaking cybercriminal operator is unconfirmed, with no tracked group matched. Adverse Trace will monitor for further Flowise and agent-platform exploitation reporting, will re-issue this advisory if a CVE or KEV entry is assigned to the features abused here, and recommends clients complete the P1 credential rotation and egress block before treating the exposure as closed. --- [Read the original source →](https://www.sekoia.com/blog/a-honeypots-tale-deconstructing-an-attack-on-genai-infrastructure?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*