AI-assisted cloud breach achieved in record 8 minutes

According to HackRead, a recent cyberattack demonstrated an unprecedented speed, with threat actors gaining complete control of a company's cloud environment in just eight minutes.

The attack originated from exposed test credentials found in a public S3 bucket. Attackers utilized a ReadOnlyAccess policy to map the victim's infrastructure, including databases and security keys. Through code injection targeting Lambda functions, they escalated privileges, eventually hijacking an account named "frick" to achieve full administrative control. Evidence suggests the use of Large Language Models (LLMs) for automation, indicated by the rapid code modifications, comments and AI-generated code with hallucinated AWS account IDs. The breach extended to LLMjacking, where the compromised account was used to run expensive AI models and attempt to train custom AI, potentially costing the victim over $23,600 monthly for a single GPU machine.

This incident underscores the evolving threat landscape where AI accelerates attack timelines from days to minutes. Experts emphasize the critical need for robust cloud security practices, including eliminating exposed credentials and implementing IAM roles for temporary access. The attack also highlights the importance of monitoring for unusual activity like massive enumeration.

“AWS services and infrastructure are not affected by this issue, and they operated as designed throughout the incident described. The report describes an account compromised through misconfigured S3 buckets,“ an AWS spokesperson said in a statement.

Source: HackRead