Threats · 19h ago

AWS intrusion split across accounts by a 14-day pause

Elastic Security Labs reconstructed a 16-day CyberStrikeAI intrusion that used stolen credentials from eight AWS identities across four accounts, generating 78 low- or medium-severity alerts. The researchers describe it as their first observed use of CyberStrikeAI tooling against AWS, but cannot establish that an AI agent made operational decisions.

The attacker made ordinary requests to AWS services, including reading stored secrets and scripts used to configure cloud instances, then went quiet for 14 days before returning. Six detection rules caught only fragments: the requests resembled legitimate activity, and the gap outlasted the preset windows rules use to link events, leaving alerts looking low-priority and disconnected.

For teams whose cloud alerts link events only within short windows, credential misuse that resumes after a long pause can stay split across accounts. Shared infrastructure and identity context may be what reveals one operation, in AWS or another cloud.

Timeline

• Nov 13 Reported by Elastic Security Labs

Sources

1 source covering this story

• Elastic Security Labs Nov 13

  CyberStrikeAI hit AWS: 56 API calls in 141 milliseconds

  Eight AWS identities, four accounts, 16 days.

Part of the PlainSec briefing for 2026-11-14

Editions

• Briefing for 2026-11-14
• Briefing for 2026-11-13

Related stories

• ScreenConnect malware spreads through hijacked technician sessions
• FaceStealer seizure shows how Sapphire Sleet reuses victims
• SilentAir hijacks Asian carriers to intercept calls and texts