CyberStrikeAI compromises four AWS accounts over 16 days using stolen credentials and rapid API calls
Between September 30 and October 16, 2026, a CyberStrikeAI server exploited stolen credentials from eight AWS identities across four accounts, executing a series of automated API calls. Notably, it made 56 EC2 user data retrieval requests in 141 milliseconds, followed by intermittent activity including secrets harvesting, SSM parameter decryption, and remote command execution. Elastic detection rules generated 78 alerts of medium or low severity, which individually appeared routine but correlated to a sustained intrusion lasting days with a 14-day silent gap. The attacker likely used compromised EC2 instance role credentials obtained via instance profile compromise, with infrastructure linked to three IPs hosting CyberStrikeAI web interfaces. Elastic Security Labs recommends behavioral detection, credential rotation, and review of secrets exposed in EC2 user data. The case underscores challenges in alert correlation for AI-assisted attacks that exhibit bursty and sporadic behaviors at machine speed.
Linha do tempo
-
CyberStrikeAI compromises four AWS accounts over 16 days using stolen credentials and rapid API calls
ler a análise desta fonte ocultar
Between September 30 and October 16, 2026, a CyberStrikeAI server exploited stolen credentials from eight AWS identities across four accounts, executing a series of automated API calls. Notably, it made 56 EC2 user data retrieval requests in 141 milliseconds, followed by intermittent activity including secrets harvesting, SSM parameter decryption, and remote command execution. Elastic detection rules generated 78 alerts of medium or low severity, which individually appeared routine but correlated to a sustained intrusion lasting days with a 14-day silent gap. The attacker likely used compromised EC2 instance role credentials obtained via instance profile compromise, with infrastructure linked to three IPs hosting CyberStrikeAI web interfaces. Elastic Security Labs recommends behavioral detection, credential rotation, and review of secrets exposed in EC2 user data. The case underscores challenges in alert correlation for AI-assisted attacks that exhibit bursty and sporadic behaviors at machine speed.