CGI Sweden / Funktionstjänster.se — Source Code Leak

Attack Chain

According to the threat actor's own documentation:

1. Jenkins compromise — Initial access via Jenkins CI server
2. Docker escape — The Jenkins user was a member of the Docker group, enabling container breakout
3. SSH key pivoting — Private SSH keys used for lateral movement
4. Java heap dumps — Passwords extracted from process memory
5. SQL COPY TO PROGRAM — Code execution via PostgreSQL

Scope

21 repositories

The leak encompasses 21 Git repositories including systems for JWT/SAML key management, corporate representative registry (IAM), digital signing, SHS integration, workflow engine, and citizen portals. Several repositories contain complete Docker Swarm configurations for production environments.

64 certificate/key files

A total of 64 files of type .jks, .p12, .pfx,.pem, and .key were found. We successfully opened 36 of these using passwords extracted from configuration files in the same leak.

The certificates belong to multiple Swedish government agencies and organizations, issued by ExpiTrust EID CA among others. Several SHS client certificates (Spridnings- och Hämtningssystem) have recently expired but were valid at the time of the leak.

SHS — Secure Data Exchange Protocol

SHS (Spridnings- och Hämtningssystem) is a Swedish-developed protocol for secure information exchange between government agencies. It is used by central government agencies, municipalities, and organizations to send electronic documents, retrieve data, and subscribe to information feeds. SHS is effectively the backbone of Swedish e-government.

SHS uses mTLS (mutual TLS) for authentication — the client certificates identify the organization to SHS nodes. The leak contains SHS client certificates for multiple government agencies. Anyone possessing a valid client certificate can impersonate that organization and directly retrieve or submit data to other agencies that the organization has SHS agreements with.

Credentials

More than 30 unique passwords were found in plaintext in configuration files, Docker secrets, and YAML files. These include:

• Keystore passwords for SAML signing certificates (validated — keystores opened successfully)
• Database credentials for PostgreSQL and MSSQL (same password reused across at least 8 separate database environments)
• OAuth2 client secrets and API keys for Bolagsverket and Mina Ombud integrations
• SMTP credentials (Gmail accounts in plaintext)
• SVN credentials for CGI's internal version control server (AD account)
• JWT signing secrets (256 characters, in plaintext)
• CI/CD credentials — access to Artifactory (build artifacts) using the same password as the databases

Disabled Security Controls

Multiple critical security controls were explicitly disabled or missing in production configurations:

• JWT validation disabled — Incoming JWT tokens are not validated in the gateway service
• SAML assertions accepted unsigned — Sweden Connect SP metadata does not require signed assertions
• Unauthenticated SHS integration endpoints — eintegration3 (the SHS integration platform) exposes /reload, /start, /stop, and /get-routes without authentication, allowing control over government data exchange message flows

Affected Organizations

The following organizations are confirmed via source code and configuration in the leak. The type of exposure varies from complete infrastructure configuration to client certificates and customer configuration.

An additional 7 organizations identified via organization numbers in Signe configurations.

Threat Actor: ByteToBreach

ByteToBreach is a threat actor active since June 2025, with documented breaches against airlines, banks, healthcare providers, and government agencies in over 10 countries. The actor uses a combination of infostealer logs, brute force, and exploits against known vulnerabilities for initial access.

The day before the CGI leak, ByteToBreach published a complete passenger database from Viking Line(via Apache Solr LFI + Tomcat credentials), suggesting a coordinated campaign against Swedish infrastructure via CGI's managed services.

Carl-Oskar Bohlin (Minister for Civil Defence) has confirmed the leak. CERT-SE and the National Cyber Security Centre are investigating the incident.

Certificate Transparency

149 unique certificates in CT logs since 2008. Key observations:

• Entrust → DigiCert emergency migration (2024) — 43 Entrust certificates had to be replaced due to distrust
• Wildcard certificate reissued 2026-03-13 via DigiCert — indicates active incident response
• IdP lacks DNS A record — the primary IdP is unreachable despite a valid certificate (until 2027)
• No DMARC record configured — phishing risk for an authentication domain

Risk Assessment

Recommendations

Immediate (0–48 hours)

1. Rotate ALL signing keys — SAML, JWT, TLS — and publish new metadata
2. Change ALL exposed passwords — database, keystore, SMTP, SVN, OAuth
3. Enable JWT validation and require signed SAML assertions
4. Review access logs for all connected government agencies

Short term (1–2 weeks)

1. Migrate all signing keys to HSM
2. Implement unique password policy per environment (prod ≠ staging ≠ test)
3. Configure DMARC for funktionstjänster.se
4. Review all SPs: ensure signed assertion requirements
5. Implement Certificate Transparency monitoring

Medium term (1–3 months)

1. Secrets management — migrate all passwords to Vault or equivalent
2. Network segmentation — separate prod/staging/test
3. Notification to IMY (Swedish DPA) under GDPR (72-hour rule)
4. Reporting under the Cybersecurity Act / NIS2

How Pentesting.se Helps

This incident highlights multiple attack surfaces that automated security scanning can identify before a leak occurs: