> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cast AI Data Leak Claim Includes AWS, GCP and GitLab Backups Across 20 GB Archive
- URL: https://darkwebinformer.com/cast-ai-data-leak-claim-includes-aws-gcp-and-gitlab-backups-across-20-gb-archive/
- Published: 2026-10-16T16:44:53.000Z
- Updated: 2026-10-16T16:44:53.000Z
- Author: Dark Web Informer
- Tags: Leaks

Data Exposure Report Cloud Infrastructure Source Code & Backups 20 GB Download Claim Unverified 

## Cast AI Data Leak Claim Includes AWS, GCP and GitLab Backups Across 20 GB Archive

Claimed size20 GB

Cloud platformsAWS + GCP

Code platformGitLab

Unlock cost1 point

Severity HIGH 

### Overview

An actor using the handle **"0xRune"** claims to have uploaded approximately **20 GB of Cast AI data**. The listing describes the material as a multi-cloud and multi-region infrastructure backup and development environment containing AWS, GCP and GitLab-related data.

The post specifically references **AWS Lambda deployment packages, S3 backups, infrastructure-state data, billing exports and a GitLab backup dated October 5, 2026**. It also says the GitLab material contains source code for AI agents, LLM routers, incident-management tooling and multi-cloud infrastructure including Terraform, GitOps, GKE and AKS-related content. **The archive, its source, the stated 20 GB size and the claimed contents have not been independently verified.**

### Post details

OrganizationCast AI

SectorCloud infrastructure / Kubernetes optimization

Actor"0xRune"

Claimed size20 GB

Cloud platforms namedAWS, GCP

Code platform namedGitLab

Unlock access1 point required

Post date shownOct 16, 2026 at 2:32 PM

### What the post claims

- 20 GB archive advertised
- AWS Lambda backup material
- Deployment packages across multiple AWS regions
- EC2 event handling references
- Local Kubernetes test-cluster material
- AWS S3 backup content
- Infrastructure-state and test-cluster configurations
- Network add-on configuration
- PKI security certificate material
- Historical etcd snapshots
- Billing exports in Parquet format
- GitLab backup dated October 5, 2026
- Source code for AI agents
- LLM router code
- Incident-management tooling
- Terraform and GitOps content
- GKE and AKS-related infrastructure code
- Spot-instance and GPU-sharing optimization code

The listing describes a mixed infrastructure and development-data collection rather than a single database. No underlying files, credentials, secrets or source-code contents are visible in the supplied screenshot.

Sponsored

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

### Screenshots

[ Screenshot 1Source screenshot ![Listing claiming a 20 GB Cast AI archive containing AWS, GCP and GitLab backup and development material](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/cast_ai.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/cast%5Fai.png) 

The supplied capture shows the Cast AI claim and a high-level breakdown of the allegedly included AWS Lambda, S3, billing, GitLab and multi-cloud development material. The hidden download requires 1 point.

### IOCs & identifiers

Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the data claim.

| Type                      | Identifier  | Source       |
| ------------------------- | ----------- | ------------ |
| Actor handle              | 0xRune      | Screenshot 1 |
| Named organization domain | cast\[.\]ai | Screenshot 1 |

The domain identifies the organization named in the claim, not malicious infrastructure. No malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled IP address is visible in the supplied material.

### Mapped techniques

**Claimed** identifies behavior explicitly described by the actor. **Inferred** identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.

- Collection [T1213.003](https://attack.mitre.org/techniques/T1213/003/) [Data from Information Repositories: Code Repositories](https://attack.mitre.org/techniques/T1213/003/) Inferred The listing explicitly references a GitLab backup containing source-code repositories and infrastructure code.
- Collection [T1530](https://attack.mitre.org/techniques/T1530/) [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/) Inferred The post describes S3 backup content and cloud-hosted infrastructure data, consistent with collection from cloud storage if the claim is accurate.

### Potential impact

If authentic, the claimed archive could expose **source code, infrastructure configuration, deployment packages, PKI-related material, historical cluster state, billing data and multi-cloud operational details**. Depending on the underlying files, that could create risks involving source-code disclosure, credential or secret exposure, infrastructure mapping, supply-chain abuse or follow-on compromise.

### Status Unverified

Dark Web Informer has **not independently verified** the archive's authenticity, source, 20 GB size, backup dates, file structure or current availability. The supplied screenshot documents the listing and the actor's summary of the archive, not independent confirmation of the underlying files.

Want everything on this threat? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=cast-ai-data-leak-2026-10-16&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=cast-ai-data-leak-2026-10-16&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=cast-ai-data-leak-2026-10-16&utm%5Fcontent=footer)