Hackers Using AI to Get AWS Admin Access Within 10 Minutes

Cybersecurity: AI-Assisted Cloud Intrusion Analysis

Recent findings from the Sysdig Threat Research Team (TRT) reveal that threat actors using artificial intelligence tools have significantly accelerated the cloud attack lifecycle, reducing the time from hours to mere minutes.

In November 2025, an incident involved adversaries escalating from initial credential theft to full administrative privileges in under 10 minutes. This was achieved by leveraging large language models (LLMs) to automate reconnaissance, generate malicious code, and make real-time attack decisions.

The operation targeted an Amazon Web Services (AWS) environment, showcasing how AI has enhanced the speed and complexity of cloud-based attacks. The compromise began with attackers finding valid AWS credentials in publicly accessible Simple Storage Service (S3) buckets containing Retrieval-Augmented Generation (RAG) data for AI models.

The compromised credentials belonged to an Identity and Access Management (IAM) user with read and write permissions on AWS Lambda and restricted access to Amazon Bedrock.

Using the ReadOnlyAccess policy, attackers conducted extensive reconnaissance across multiple AWS services, including Secrets Manager, Systems Manager, EC2, ECS, RDS, and CloudWatch. They then exploited UpdateFunctionCode and UpdateFunctionConfiguration permissions on Lambda to inject malicious code into an existing function named EC2-init.

After several attempts, they compromised an admin account named "frick" by creating new access keys. The Lambda script indicated the use of large language models for code generation, featuring comprehensive exception handling, a 30-second timeout modification, and Serbian-language comments.

Researchers identified several AI hallucinations and a fabricated GitHub repository, along with session names reflecting AI-assisted methodology. The attackers distributed operations across 19 distinct AWS principals, including six different IAM roles across 14 sessions and five compromised IAM users. They created a backdoor user named "backdoor-admin" with the AdministratorAccess policy attached.

After disabling model invocation logging, the attackers targeted Amazon Bedrock with LLMjacking operations, invoking multiple foundation models. They employed a Terraform module to deploy a backdoor Lambda function, generating Bedrock credentials accessible via a Lambda URL without authentication.

The attackers shifted focus to EC2 compute resources, querying over 1,300 Amazon Machine Images for deep learning applications. They provisioned a p4d.24xlarge instance costing $32.77 per hour, approximately $23,600 monthly, with user data scripts to install CUDA, PyTorch, and a publicly accessible JupyterLab server, providing backdoor access independent of AWS credentials.

Multiple defense evasion tactics were employed, including an IP rotator tool to change source addresses for each request, bypassing security measures.

Organizations should implement least privilege principles for all IAM users and roles, restrict UpdateFunctionConfiguration and PassRole permissions, enable Lambda function versioning for immutable code records, ensure S3 buckets with sensitive data are not publicly accessible, enable model invocation logging for Amazon Bedrock, and monitor for IAM Access Analyzer enumeration activity.

As LLMs advance, such attacks are expected to become more prevalent, necessitating enhanced runtime detection capabilities and strict enforcement of least-privilege principles.

IP Address VPN

104.155.129[.]177 Yes 104.155.178[.]59 Yes 104.197.169[.]222 Yes 136.113.159[.]75 Yes 34.173.176[.]171 Yes 34.63.142[.]34 Yes 34.66.36[.]38 Yes 34.69.200[.]125 Yes 34.9.139[.]206 Yes 35.188.114[.]132 Yes 35.192.38[.]204 Yes 34.171.37[.]34 Yes 204.152.223[.]172 Yes 34.30.49[.]235 Yes 103.177.183[.]165 No 152.58.47[.]83 No 194.127.167[.]92 No 197.51.170[.]131 No

Based on reporting by Cyber Security News.