Hackers Using AI to Get AWS Admin Access Within 10 Minutes

Artificial intelligence tools are enabling threat actors to reduce the cloud attack lifecycle from hours to mere minutes, according to new findings from the Sysdig Threat Research Team (TRT).

In a November 2025 incident, adversaries escalated from initial credential theft to full administrative privileges in less than 10 minutes by using large language models (LLMs) to automate reconnaissance, generate malicious code, and execute real-time attack decisions.

The operation targeted an Amazon Web Services (AWS) environment, demonstrating how AI assistance has fundamentally transformed the speed and sophistication of cloud-based attacks.

The compromise began when attackers discovered valid AWS credentials stored in publicly accessible Simple Storage Service (S3) buckets containing Retrieval-Augmented Generation (RAG) data for AI models.

The compromised credentials belonged to an Identity and Access Management (IAM) user with read and write permissions on AWS Lambda and restricted access to Amazon Bedrock.

With the compromised IAM user possessing the ReadOnlyAccess policy, attackers conducted extensive reconnaissance across multiple AWS services, including Secrets Manager, Systems Manager, EC2, ECS, RDS, and CloudWatch.

The threat actors then exploited UpdateFunctionCode and UpdateFunctionConfiguration permissions on Lambda to inject malicious code into an existing function named EC2-init. After three iterative attempts, they successfully compromised an admin account named “frick” by creating new access keys.

Multiple indicators throughout the operation suggest the threat actor leveraged large language models for code generation. The Lambda script featured comprehensive exception handling, a 30-second timeout modification, and Serbian-language comments (“Kreiraj admin access key” meaning “Create admin access key”), suggesting the attacker’s origin.

Researchers identified several AI hallucinations,s including attempts to assume roles in fabricated AWS account IDs with sequential patterns (123456789012 and 210987654321), references to a non-existent GitHub repository, and session names like “claude-session” reflecting AI-assisted methodology.

The attackers demonstrated sophisticated persistence by distributing operations across 19 distinct AWS principals, including six different IAM roles across 14 sessions and five compromised IAM users. They created a backdoor user named “backdoor-admin” with the AdministratorAccess policy attached.

After confirming that model invocation logging was disabled, the attackers pivoted to LLMjacking operations targeting Amazon Bedrock. They invoked multiple foundation models, including Claude Sonnet 4, Claude Opus 4, Claude 3.5 Sonnet, DeepSeek R1, Llama 4 Scout, Amazon Nova Premier, and Amazon Titan Image Generator.

Researchers discovered a Terraform module designed to deploy a backdoor Lambda function that would generate Bedrock credentials and expose them through a publicly accessible Lambda URL requiring no authentication.

The attackers shifted focus to EC2 compute resources, querying over 1,300 Amazon Machine Images for deep learning applications. They successfully provisioned a p4d.24xlarge instance costing $32.77 per hour (approximately $23,600 monthly) with user data scripts to install CUDA, PyTorch, and a publicly accessible JupyterLab server on port 8888, providing backdoor access independent of AWS credentials.

The threat actors employed multiple defense evasion tactics including an IP rotator tool to change source addresses for each request, bypassing security measures that correlate operations from the same IP.

Organizations should implement least privilege principles for all IAM users and roles, restrict UpdateFunctionConfiguration and PassRole permissions, enable Lambda function versioning for immutable code records, ensure S3 buckets with sensitive data are not publicly accessible, enable model invocation logging for Amazon Bedrock, and monitor for IAM Access Analyzer enumeration activity.

As LLMs become increasingly sophisticated, attacks of this nature will likely become more common, requiring organizations to prioritize runtime detection capabilities and least-privilege enforcement to defend against this accelerating threat landscape.

Indicators of Compromise

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.