InfoSecBulletin Cybersecurity for mankind
A major AWS attack shows how attackers with AI can connect known cloud strategies to go from first access to complete control in about 72 hours, not with new tools, but with very fast and organized actions.
According to Sygnia’s investigation, the threat actor got access to an AWS account by taking advantage of a flaw in an internet-facing app, then moved through various applications, cloud systems, code storage, CI/CD pipelines, and services running in real-time.
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Each newly harvested credential triggered a renewed wave of discovery, secrets collection, persistence attempts, and impact-oriented actions, creating overlapping “attack waves” rather than a single linear kill chain.
Signs of AI-Assisted Operations
Multiple clues showed that AI tools helped run the campaign. In one clear case, four different access keys linked to four accounts were used from the same source IP and user-agent in just one second. This level of speed is hard to explain with human work.
The actor ran many different SQL queries on many databases and quickly found links between cloud queues, workers, and deployment files. This showed the need for special changes instead of just using one-size-fits-all scripts.
Attacker-created artifacts were also framed as an authorized “pentest” or “red team” exercise, potentially to mislead investigators or to reduce refusals from AI tools that generate offensive code.
This discovery fits with wider trends in the industry seen in 2026, where security experts have reported AI speeding up cloud attack times.
Sysdig’s Threat Research Team described a November 2025 event where a hacker used large language models to quickly gain full AWS control in eight minutes by adding harmful code to a Lambda function.
| Attack Dimension | Traditional Intrusion | AI-Accelerated Intrusion |
|---|---|---|
| Attack path | Linear progression through stages | Overlapping “waves” triggered by each new credential |
| Technique execution | Selective, targeted actions | Broad “checklist” execution across many known techniques |
| Concurrency | Sequential, single-operator pace | Multiple identities operated in parallel simultaneously |
| Tooling | Pre-built scripts reused | Custom scripts generated on demand for new surfaces |
| Credential management | Manual tracking | Persistent “operational memory” across dozens of keys |
This case also did not use any zero-days or new malware. It only had stolen credentials, regular AWS services, and AI help for gathering information, gaining access, and moving sideways through 19 different AWS identities.
Vectra AI researchers noted that AI “removed friction” from the attack, letting the actor enumerate services and evaluate privilege paths faster than any manual operator could.
Sygnia’s CISO Survey 2026 showed that 73% of 600 top security leaders think their companies will not be ready for a major cyberattack happening “tomorrow.”
Sygnia suggests changing how we handle incidents from a step-by-step method to one that works on investigation and containment at the same time. Key defensive priorities are:
Assume credential exposure and rotate all secrets, keys, and tokens aggressively across cloud, CI/CD, and application layers.
Enforce identity-first security, including MFA, session revocation, and disabling compromised accounts immediately.
Apply broad network containment (IP allowlisting, outbound restrictions, WAF enforcement) as a first response action.
Automate detection, credential rotation, and containment workflows to match attacker speed.
Rebuild compromised non-production environments from trusted infrastructure-as-code templates rather than attempting full manual eradication.
Removing old IAM credentials, limiting AI service permissions, and viewing identity as very important infrastructure are now key measures against fast AI cloud attacks.
The main lesson from these 2026 events is clear: as the use of offensive AI speeds up and works through all parts of an attack, those defending must keep up with automated responses that are well connected, instead of using separate, individual tools.
