Skip to content

JINX-0163 / FulcrumSec

Summary

JINX-0163 is a financially motivated, cloud-native extortion cluster that Wiz Research says it began tracking in 2026. Wiz assesses with moderate confidence that FulcrumSec, the name used in victim extortion messages, is JINX-0163's public-facing identity, while leaving open the possibility that FulcrumSec is an extortion-as-a-service role shared by multiple actors.

The cluster targets non-human cloud identities such as service accounts and IAM roles, moves quickly across AWS, Azure, Google Cloud, Okta, and Snowflake, steals data and secrets, and uses the resulting access for extortion.

Tags

Why this matters

  • JINX-0163 prioritizes machine identities rather than end-user accounts, so user-centered phishing and sign-in detections are not sufficient.
  • A single over-privileged service account, IAM role, or exposed infrastructure state file can expose a broad secret inventory across projects and platforms.
  • Cloud-hosted AI development platforms can combine powerful service identities, customer credentials, code execution, and cross-project reach in one control plane.
  • Short-lived policy and permission changes can create external access and then be removed before a routine review.

Publicly reported activity

Wiz's August 6, 2026 H1 threat review describes JINX-0163 as a cloud-native extortion gang discovered by one of Wiz's AI-enabled threat-hunting systems. Wiz says the group consistently targets service accounts and IAM roles and can use one over-privileged identity or exposed state file to obtain an organization's secret inventory.

In the most severe incident described publicly, JINX-0163 compromised a cloud-hosted AI development platform. Initial access was through one Google Cloud service account; the actor then moved laterally and extracted thousands of secrets across multiple GCP projects, including customer credentials. The public report does not name the victim, provide timestamps or indicators, or identify how the service-account key was first exposed.

Wiz says multiple victims later received messages from an actor calling itself FulcrumSec, claiming terabytes of stolen data and threatening disclosure unless paid. The report assesses financial motivation and extortion as the end goal. It does not establish whether every FulcrumSec communication came from one operator.

Tradecraft

Identity and discovery

  • Targets non-human identities, especially service accounts and IAM roles.
  • Exploits excessive permissions and exposed state files to enumerate secrets.
  • Operates across AWS, Azure, GCP, Okta, and Snowflake.
  • Moves quickly and at scale after obtaining a valid identity.

Lateral movement and collection

  • Pivots across cloud projects and services using valid machine credentials.
  • Enumerates and extracts managed secrets and customer credentials.
  • Targets cloud-hosted AI development platforms where service identities can bridge infrastructure and customer data.

Persistence and defense evasion

Wiz's half-year review also records techniques worth testing against this cluster and other cloud intruders, although it does not attribute every example in that section specifically to JINX-0163:

  • Creating a second access key on an existing administrator's IAM user so persistence hides behind a legitimate employee identity. Alert when the principal making CreateAccessKey is not the owner of the target account.
  • Adding a foreign domain to GCP allowedPolicyMemberDomains, granting an external account project editor access, then removing the grant and organization-policy change within about 30 minutes. Correlate unusual SetOrgPolicy with subsequent SetIamPolicy in the same session.
  • Using managed Kubernetes access to invoke a cloud VM Run Command API against underlying nodes, bypassing container-level controls; monitor Azure Activity Log VM Run Command operations.
  • Reusing Linux EC2 instance-role credentials from a Windows attacker host. In CloudTrail, an os/windows Boto3 user agent on a Linux instance role plus the m/e (CREDENTIALS_CODE) feature-flag combination can identify explicitly loaded stolen credentials. Wiz characterizes this combination as a near-zero-false-positive signal, but defenders should validate it against their own automation.

Defender priorities

  1. Inventory service accounts, IAM roles, workload identities, state files, and automation credentials; remove unused keys and excessive secret-read permissions.
  2. Alert on machine credentials used from new networks, operating systems, user agents, cloud regions, or services.
  3. Detect broad secret enumeration and cross-project access from identities that normally have narrow scope.
  4. Monitor CreateAccessKey where caller and target identity differ.
  5. Monitor GCP organization-policy changes involving allowedPolicyMemberDomains, especially when followed by external SetIamPolicy grants and rapid cleanup.
  6. Review VM Run Command activity against Kubernetes worker nodes and other managed compute.
  7. Preserve cloud audit logs, identity-provider logs, state-file access logs, secret-access records, and extortion messages before remediation.
  8. Rotate exposed machine credentials only after containing active sessions and identifying downstream secrets reachable through them.

Attribution and evidence limits

  • JINX-0163 is a Wiz tracking label; do not treat it as a legal identity.
  • Wiz assesses the FulcrumSec linkage with moderate confidence and explicitly leaves open an extortion-as-a-service model.
  • The public report does not provide indicators, victim names, malware, or an initial-access root cause for the AI-platform incident.
  • The detection examples in Wiz's broader technique section should not all be attributed to JINX-0163 without additional reporting.

Sources