MCP Dev Summit BLR 2026 — Operation CipherFall

Disclaimer: ExamplePay is a completely fictitious company name used purely for demonstration purposes in this NightWatch Workshop. Any resemblance to real companies, products, or services is entirely coincidental.

Bridging MCP and ADK for Autonomous Cross-Cloud Site Reliability Engineer (SRE) Operations

Workshop Track: MCP Dev Summit, Bengaluru 2026

Duration: 1 hour

Format: Jupyter Notebooks (hands-on, audience runs along)

---

NightWatch Workshop - The Story

ExamplePay is a Business-to-Business (B2B) payments infrastructure company processing settlement batches across India and Southeast Asia. At 02:10 AM IST, a faulty Infrastructure-as-Code (Terraform) deployment accidentally exposes an internal monitoring port to the public internet. This triggers a subtle but critical chain of events:

The Attack Chain

1. Initial Access (Ingress): ExamplePay’s core payment application runs on Google Kubernetes Engine (GKE) alongside a helper container (batch-export-sidecar) tasked with temporarily storing and archiving settlement files. For observability, this sidecar exposes a Spring Boot Actuator management dashboard on port 8080. The faulty Terraform deployment accidentally applies an allow-all-8080 firewall rule to the production environment, exposing this sidecar to the internet. The attacker discovers the open port and exploits an unpatched public vulnerability (CVE) (e.g., Spring4Shell) in the Actuator dashboard to gain Remote Code Execution (RCE) inside the sidecar container.
2. Command and Control (Egress): Because the VPC relies on GCP’s implied “default allow” egress rule instead of a strict zero-trust deny list, the attacker successfully establishes a reverse-shell connection back to their external Command and Control (C2) server (198.51.100.42).
3. Privilege Escalation: Now operating inside the perimeter, the attacker hijacks the GKE Workload Identity attached to the Pod (svc-batch-export). Due to a common IAM misconfiguration, this Service Account has been granted an overly permissive role (e.g., roles/editor). This excessive permission allows the attacker to mint a new JSON persistence key for themselves to ensure continued access even if the container is restarted.
4. Data Exfiltration: Using the compromised identity, the attacker executes gcloud storage cp to siphon local settlement batch files from the container’s storage volume out to an unregistered external GCS Bucket.

The Detection Gap

To avoid detection, the attacker explicitly throttles the exfiltration speed within their scripts. By keeping the egress byte rate deliberately below deterministic volume-based pager thresholds (“low and slow”), standard alerting rules fail to fire. With no explicit security alerts triggered to wake the on-call Site Reliability Engineer (SRE), the human team remains completely unaware of the active breach.