InfoSecBulletin Cybersecurity for mankind
A major AWS attack shows how attackers with AI can connect known cloud strategies to go from first access to complete control in about 72 hours, not with new tools, but with very fast and organized actions.
According to Sygnia’s investigation, the threat actor got access to an AWS account by taking advantage of a flaw in an internet-facing app, then moved through various applications, cloud systems, code storage, CI/CD pipelines, and services running in real-time.
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Each newly harvested credential triggered a renewed wave of discovery, secrets collection, persistence attempts, and impact-oriented actions, creating overlapping “attack waves” rather than a single linear kill chain.
Signs of AI-Assisted Operations
Multiple clues showed that AI tools helped run the campaign. In one clear case, four different access keys linked to four accounts were used from the same source IP and user-agent in just one second. This level of speed is hard to explain with human work.
The actor ran many different SQL queries on many databases and quickly found links between cloud queues, workers, and deployment files. This showed the need for special changes instead of just using one-size-fits-all scripts.
Attacker-created artifacts were also framed as an authorized “pentest” or “red team” exercise, potentially to mislead investigators or to reduce refusals from AI tools that generate offensive code.
This discovery fits with wider trends in the industry seen in 2026, where security experts have reported AI speeding up cloud attack times.
Sysdig’s Threat Research Team described a November 2025 event where a hacker used large language models to quickly gain full AWS control in eight minutes by adding harmful code to a Lambda function.
| Attack Dimension | Traditional Intrusion | AI-Accelerated Intrusion |
|---|---|---|
| Attack path | Linear progression through stages | Overlapping “waves” triggered by each new credential |
| Technique execution | Selective, targeted actions | Broad “checklist” execution across many known techniques |
| Concurrency | Sequential, single-operator pace | Multiple identities operated in parallel simultaneously |
| Tooling | Pre-built scripts reused | Custom scripts generated on demand for new surfaces |
| Credential management | Manual tracking | Persistent “operational memory” across dozens of keys |
This case also did not use any zero-days or new malware. It only had stolen credentials, regular AWS services, and AI help for gathering information, gaining access, and moving sideways through 19 different AWS identities.
Vectra AI researchers noted that AI “removed friction” from the attack, letting the actor enumerate services and evaluate privilege paths faster than any manual operator could.
Sygnia’s CISO Survey 2026 showed that 73% of 600 top security leaders think their companies will not be ready for a major cyberattack happening “tomorrow.”
Sygnia suggests changing how we handle incidents from a step-by-step method to one that works on investigation and containment at the same time. Key defensive priorities are:
Assume credential exposure and rotate all secrets, keys, and tokens aggressively across cloud, CI/CD, and application layers.
Enforce identity-first security, including MFA, session revocation, and disabling compromised accounts immediately.
Apply broad network containment (IP allowlisting, outbound restrictions, WAF enforcement) as a first response action.
Automate detection, credential rotation, and containment workflows to match attacker speed.
Rebuild compromised non-production environments from trusted infrastructure-as-code templates rather than attempting full manual eradication.
Removing old IAM credentials, limiting AI service permissions, and viewing identity as very important infrastructure are now key measures against fast AI cloud attacks.
The main lesson from these 2026 events is clear: as the use of offensive AI speeds up and works through all parts of an attack, those defending must keep up with automated responses that are well connected, instead of using separate, individual tools.
