CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Amazon EC2

product · product:amazon-ec2 single-source

Coverage
1
first 2026-11-14 → last 2026-11-14
Latest activity
2026-11-14
Elastic: CyberStrikeAI against AWS, six medium or low alerts joined only by source IP; alert on user-data…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Defender insights

What each entry about Amazon EC2 tells a defender to do, newest first.

2026-11-14NOTABLEElastic: CyberStrikeAI against AWS, six medium or low alerts joined only by source IP; alert on user-data bursts

Exposure · triage · detection

Story timeline

  1. 2026-11-14CyberStrikeAI turned on AWS: Elastic reads one server's 16 days across eight identities in four accounts, 56 user-data reads in 141 milliseconds, and why six detections each rated medium or low and only the source address tied them together
    active-threatsElastic: CyberStrikeAI against AWS, six medium or low alerts joined only by source IP; alert on user-data bursts

Hunting pivots

Releases covered
Amazon EC2
Tags
ai-abusecloud
ATT&CK techniques (5 across 7 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Cloud Accounts
  • ExecutionCloud Administration Command
  • PersistenceValid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts: Cloud Accounts
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials: Cloud Instance Metadata API · Credentials from Password Stores: Cloud Secrets Management Stores
  • DiscoveryAccount Discovery: Cloud Account

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Execution TA0002

T1651Cloud Administration Command×1

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Credential Access TA0006

T1552.005Unsecured Credentials: Cloud Instance Metadata API×1

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

T1555.006Credentials from Password Stores: Cloud Secrets Management Stores×1

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Discovery TA0007

T1087.004Account Discovery: Cloud Account×1

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Evidence: 2026-11-14/cyberstrikeai-aws-cloudtrail-intrusion-one-source-ip · ATT&CK page ↗

Entries about Amazon EC2 (1)

2026-11-14 · view entry permalink →

NOTABLENATOB2

CyberStrikeAI turned on AWS: Elastic reads one server's 16 days across eight identities in four accounts, 56 user-data reads in 141 milliseconds, and why six detections each rated medium or low and only the source address tied them together

Between 2026-09-30 and 2026-10-16 one server serving a CyberStrikeAI web interface used the credentials of eight AWS identities (five IAM users and three EC2 instance roles) across four accounts and generated 78 alerts, the first case Elastic has seen of this tooling turned on AWS (Elastic Security Labs, 2026-11-13). It started by validating identities: GetCallerIdentity on four IAM users in three accounts within 51 minutes, three of the calls in the same second (Elastic Security Labs, 2026-11-13). An instance role then read a secret, made one user-data request and fired 56 more in 141 milliseconds, spacing Elastic says fits tooling working through a prepared list of instance IDs (Elastic Security Labs, 2026-11-13). On 2026-10-02 another instance role read an encrypted Systems Manager parameter and issued a SendCommand 29 seconds later, which Elastic calls the highest-risk activity; the audit log does not show the command or its outcome (Elastic Security Labs, 2026-11-13). After 14 quiet days the server returned and revalidated credentials, including a user in a fourth account (Elastic Security Labs, 2026-11-13). Elastic does not know how the credentials were obtained and infers that the instance-role sessions, used from an outside address, were taken from the instances, for example through SSRF or host compromise (Elastic Security Labs, 2026-11-13). Team Cymru counted 21 unique addresses running CyberStrikeAI between 2026-01-20 and 2026-02-26 (Team Cymru, 2026-03-02).

Triage: each call is one a legitimate role makes every day, so the discriminators are the source address, the number of distinct identities, accounts or instances one address touches in minutes, and the decrypt-then-SendCommand pairing (Elastic Security Labs, 2026-11-13).

The main activity came from app-role, an EC2 instance role in Account A. It read a secret, made one user data request, then fired a burst of 56 user data requests in 141 milliseconds.

Only the shared source IP showed they belonged to one intrusion.

We cannot prove an LLM agent was making the decisions, and we do not know how the attacker obtained the credentials.

Elastic Security Labs 2026-11-13

Builds on: Sygnia IR: an AI-assisted AWS intrusion ran four parallel workstreams per stolen key and used… · JPCERT/CC and NICT: attackers decompile the public app, then call internal APIs; AI platforms…

threat14 Nov 03:55Zsingle-sourceOpen finding →
Sources: Elastic Security Labs · Team Cymru

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • elastic.co1 (50%)
  • team-cymru.com1 (50%)
All cited sources (2)