InfoSecBulletin Cybersecurity for mankind
A major AWS attack shows how attackers with AI can connect known cloud strategies to go from first access to complete control in about 72 hours, not with new tools, but with very fast and organized actions.
According to Sygnia’s investigation, the threat actor got access to an AWS account by taking advantage of a flaw in an internet-facing app, then moved through various applications, cloud systems, code storage, CI/CD pipelines, and services running in real-time.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Each newly harvested credential triggered a renewed wave of discovery, secrets collection, persistence attempts, and impact-oriented actions, creating overlapping “attack waves” rather than a single linear kill chain.
Signs of AI-Assisted Operations
Multiple clues showed that AI tools helped run the campaign. In one clear case, four different access keys linked to four accounts were used from the same source IP and user-agent in just one second. This level of speed is hard to explain with human work.
The actor ran many different SQL queries on many databases and quickly found links between cloud queues, workers, and deployment files. This showed the need for special changes instead of just using one-size-fits-all scripts.
Attacker-created artifacts were also framed as an authorized “pentest” or “red team” exercise, potentially to mislead investigators or to reduce refusals from AI tools that generate offensive code.
This discovery fits with wider trends in the industry seen in 2026, where security experts have reported AI speeding up cloud attack times.
Sysdig’s Threat Research Team described a November 2025 event where a hacker used large language models to quickly gain full AWS control in eight minutes by adding harmful code to a Lambda function.
| Attack Dimension | Traditional Intrusion | AI-Accelerated Intrusion |
|---|---|---|
| Attack path | Linear progression through stages | Overlapping “waves” triggered by each new credential |
| Technique execution | Selective, targeted actions | Broad “checklist” execution across many known techniques |
| Concurrency | Sequential, single-operator pace | Multiple identities operated in parallel simultaneously |
| Tooling | Pre-built scripts reused | Custom scripts generated on demand for new surfaces |
| Credential management | Manual tracking | Persistent “operational memory” across dozens of keys |
This case also did not use any zero-days or new malware. It only had stolen credentials, regular AWS services, and AI help for gathering information, gaining access, and moving sideways through 19 different AWS identities.
Vectra AI researchers noted that AI “removed friction” from the attack, letting the actor enumerate services and evaluate privilege paths faster than any manual operator could.
Sygnia’s CISO Survey 2026 showed that 73% of 600 top security leaders think their companies will not be ready for a major cyberattack happening “tomorrow.”
Sygnia suggests changing how we handle incidents from a step-by-step method to one that works on investigation and containment at the same time. Key defensive priorities are:
Assume credential exposure and rotate all secrets, keys, and tokens aggressively across cloud, CI/CD, and application layers.
Enforce identity-first security, including MFA, session revocation, and disabling compromised accounts immediately.
Apply broad network containment (IP allowlisting, outbound restrictions, WAF enforcement) as a first response action.
Automate detection, credential rotation, and containment workflows to match attacker speed.
Rebuild compromised non-production environments from trusted infrastructure-as-code templates rather than attempting full manual eradication.
Removing old IAM credentials, limiting AI service permissions, and viewing identity as very important infrastructure are now key measures against fast AI cloud attacks.
The main lesson from these 2026 events is clear: as the use of offensive AI speeds up and works through all parts of an attack, those defending must keep up with automated responses that are well connected, instead of using separate, individual tools.
