One Pilot Server, a Flat Network, and Three Terabytes Gone

This is based on a real 2026 incident that was reported in the press. The organizations are anonymized and we were not involved. The attack stages are as reported; the mapping to Nemesis layers is how those products behave, not a claim that they were deployed here.

The breach, as it happened

One external actor turned a single unprotected box into a national data breach in about nine days.

• Foothold. They fired a known CVE at a pilot server: a pre-production box that never got the controls the production fleet had. A command shell opened.
• Persistence. They dropped a modern C2 implant and sat undetected for nine days, blending into normal host activity.
• A flat network. From inside the Kubernetes cluster, a single internal scan found 168 open services: development systems running in the same trust zone as live customer systems, all reachable, none questioning the traffic.
• Lateral movement. They walked from the bank's environment into a connected payment gateway.
• Exfiltration. The prize wasn't the app. It was a misconfigured cloud storage bucket: roughly three terabytes of KYC documents, database exports, and even encryption keys, pulled straight from storage.

flowchart TB
  A["Known CVE on an<br/>unprotected pilot server"] --> B["Command shell +<br/>C2 persistence (9 days)"]
  B --> C["Flat cluster network:<br/>168 open internal services"]
  C --> D["Lateral movement to<br/>a connected payment gateway"]
  D --> E["Misconfigured cloud bucket:<br/>~3 TB of KYC / PII / keys"]

  S["Application Shield"] -. "off-baseline exploit request blocked at the app boundary" .-> A
  BL["Nemesis Blue"] -. "C2 beacon + persistence surfaced on the host" .-> B
  N["Network Shield"] -. "default-deny east-west: the 168-service scan reaches nothing" .-> C

Where each link could have been cut

No honest vendor should tell you a single agent would have stopped this. It was a chain, and different layers answer different links.

• The foothold: Application Shield. A CVE exploit is, at the HTTP layer, an off-baseline request: an unusual endpoint, an unusual body shape, a method the app never normally serves. A positive-security shield that has learned the app's real request shapes flags and blocks that request before the shell ever opens, and it does so while the framework is still unpatched. In our own testing this is exactly the class we catch (framework RCEs, deserialization endpoints, traversal, injection points that appear where they shouldn't). The honest caveat: the box that was hit was a pilot server. A shield only protects what it is actually mounted on and enforcing. The lesson writes itself: pre-production is production to an attacker.
• The persistence: the endpoint. A C2 implant living on a host for nine days is not an application-layer event. That is where an endpoint sensor belongs: catching the beacon, the anomalous process lineage, the persistence.
• The flat network: Network Shield. This is the link that turned one box into a national incident. A single scan reached 168 services because the internal network trusted everything inside it. The same positive-security principle that guards the app boundary, applied east-west (learn which service talks to which, then default-deny the rest) means that scan reaches nothing and lateral movement dies at the first hop.
• The exfiltration: cloud posture. Three terabytes left from a misconfigured bucket that the application never touched. That is a storage-configuration failure. No request shield sees a direct pull from object storage; the answer there is posture and least-privilege on the bucket itself.

What no single product would have stopped

If you take one thing from this: the breach did not win because one control failed. It won because the internal network assumed that anything already inside was safe. The exploit was ordinary. The persistence was ordinary. The catastrophic multiplier was a flat, trusting network sitting next to unlocked storage.

That is why the honest posture is layered, and why the principle matters more than any one box:

• Default-deny at the app boundary: the app only ever behaves in the ways it has been approved for.
• Default-deny east-west: services only ever talk to the peers they have been approved for.
• Watch the host: so a shell and a nine-day implant do not get nine days.

Each layer is a positive-security allow-list at a different altitude. Any one of them, alone, would have narrowed the blast radius. Together, a single exploited pilot box stays a single exploited pilot box.

The lesson

Signatures chase the last attack. This attacker used a known CVE, a common implant, and the oldest trick there is: once you are inside, keep walking, because nothing inside is watching. A model built on your own normal (at the app, on the wire between services, and on the host) is what removes the room to walk.