Loading story…
Sysdig reported observing an offensive operation against an AWS environment in which a threat actor progressed from initial access to administrative privileges in under 10 minutes, with multiple indicators suggesting large language models (LLMs) were used to accelerate reconnaissance, code generation, and decision-making. Initial access was obtained via valid credentials exposed in public S3 buckets, reportedly associated with AI/RAG-related data and an IAM user used to automate Amazon Bedrock tasks via AWS Lambda. The actor then escalated privileges via Lambda function code injection, moved laterally across 19 AWS principals, and abused Amazon Bedrock in an LLMjacking pattern while also provisioning GPU-capable compute instances for suspected model-related activity.
Dark Reading’s coverage echoed Sysdig’s findings, emphasizing the speed of the compromise, the role of AI as a force multiplier, and post-compromise activity including data collection/exfiltration and GPU instance provisioning. In contrast, TechTarget’s “must-have security technologies” piece and SecuritySenses’ discussion of borrowing financial risk models for security are general guidance/trend articles and do not describe this specific intrusion or provide incident-specific technical details, making them non-contributory to the reported AWS compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
In response to coverage of the incident, AWS stated that its services and infrastructure were not impacted and attributed the compromise to customer-side misconfiguration, including public S3 exposure and leaked credentials. AWS reiterated best practices such as least privilege, secure credential handling, and monitoring with services like GuardDuty.
Sysdig Threat Research Team publicly disclosed the incident and its analysis, describing indicators of heavy LLM assistance such as rapid script iteration, hallucinated account IDs, Serbian-language comments, and references to non-existent repositories. The company also released detections and mitigation guidance focused on least privilege, Lambda hardening, S3 access controls, and Bedrock logging.
During the intrusion, the actor used IP rotation and role chaining to reduce detection and attempted to pivot further by guessing the default OrganizationAccountAccessRole in an AWS Organization. These actions showed an effort to expand reach beyond the initially compromised account.
The operation expanded into compute abuse when the actor attempted to provision expensive GPU-backed EC2 resources, including a p4d.24xlarge instance nicknamed "stevan-gpu-monster." The attacker also exposed a JupyterLab service publicly on port 8888, apparently to support AI or ML workloads.
The attacker verified that Bedrock model invocation logging was disabled and then used the victim's account to invoke multiple foundation models, including third-party and Amazon-hosted offerings. Reports also note use of cross-Region inference and acceptance of AWS Marketplace usage agreements on the victim's behalf.
With elevated access, the attacker gathered data from services such as Secrets Manager, SSM Parameter Store, CloudWatch, S3, Lambda source code, and CloudTrail. One report also noted data exfiltration during the incident.
Following privilege escalation, the intruder moved laterally through role assumptions and access-key creation across 19 AWS identities/principals. The actor also established persistence by creating a new administrative user referred to as "backdoor-admin."
The attacker escalated privileges by modifying the EC2-init Lambda function, abusing overly permissive update capabilities to create new access keys for an administrative user named "frick." Sysdig said the actor reached administrative privileges in roughly eight minutes.
After initial access, the attacker rapidly enumerated the victim's AWS environment across services including Secrets Manager, RDS, CloudWatch, SSM, S3, Lambda, and CloudTrail. Multiple reports say this reconnaissance was likely accelerated by large language models.
On November 28, 2025, an attacker obtained valid AWS test credentials from a publicly accessible S3 bucket containing AI-related/RAG data. The exposed credentials provided initial access with ReadOnlyAccess permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourcesysdig.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security research and incident response reporting highlighted how **AI-enabled tactics** are accelerating cloud compromise and expanding the blast radius into ML systems. Sysdig described an incident in which attackers used **exposed credentials in public AWS S3 buckets** to escalate from initial access to **full administrative privileges in under 10 minutes**, then moved laterally across identities, exfiltrated data from multiple AWS services, and **injected malicious code into AWS Lambda**. The activity also included attempts to monetize access by running AI workloads through **Amazon Bedrock** and attempting **GPU hijacking in EC2**, creating potential for significant cloud cost impact; AWS characterized the root cause as **S3 misconfiguration/credential exposure** rather than an AWS infrastructure flaw. Mitiga reported a separate real-world investigation where a threat actor exploited a **path traversal** flaw in an AI-enabled file upload/summarization web application to overwrite production training data in an S3 bucket feeding an automated **SageMaker retraining pipeline**. The poisoned dataset introduced subtle label inconsistencies and a trigger pattern that, after retraining and deployment, enabled the attacker to reliably induce anomalous model behavior with crafted inputs—effectively a persistent **training data poisoning** compromise of a production AI endpoint. In contrast, Kiuwan’s post is primarily a **general advisory** on AI development supply-chain visibility risks (e.g., unvetted dependencies introduced by LLM coding assistants) and does not describe the same specific incidents or provide incident-specific indicators.
Jun 29, 2026
A financially motivated lone attacker used AI-assisted workflows to breach a large **AWS** environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, **CI/CD** pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to **S3** buckets, scaling **ECS** services to zero, blocking network access with ACL rules, and purging **SQS** queues. The incident reflects a broader shift from isolated malicious use of generative AI to **agentic AI** supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as **Claude** and **OpenAI Codex** to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple **MITRE ATT&CK** tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Jul 9, 2026Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026