Loading story…
Mandiant reported that UNC2903 targeted public-facing web applications in AWS environments to steal temporary cloud credentials by abusing the Amazon Instance Metadata Service (IMDS). The activity began in 2021 and relied on server-side request forgery (SSRF) in vulnerable applications, including Adminer affected by CVE-2021-21311, to query metadata endpoints and retrieve AWS credentials tied to the compromised instances.
After obtaining credentials, the threat actor attempted access to S3 buckets and other AWS resources in what Mandiant described as a multi-phase intrusion chain involving internet scanning, reconnaissance, exploit attempts, and manual validation before credential abuse and data theft. The report said environments still using IMDSv1 were especially exposed, while IMDSv2 and GuardDuty offer stronger defenses, and warned that similar metadata-service abuse could affect other cloud platforms with comparable features.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2024-03-25, Mandiant publicly reported UNC2903's AWS-focused metadata-service abuse, highlighting exposure from IMDSv1 and recommending mitigations such as IMDSv2 and GuardDuty.
After obtaining credentials from IMDS, UNC2903 attempted access to S3 buckets and other cloud resources as part of a multi-phase intrusion sequence that included scanning, reconnaissance, exploit attempts, manual testing, and data exfiltration.
Beginning in 2021, Mandiant observed UNC2903 targeting public-facing web applications in AWS environments and exploiting server-side request forgery flaws to query the Amazon Instance Metadata Service for temporary credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have exploited a server-side request forgery (SSRF) vulnerability in the Pandoc Linux utility, identified as CVE-2025-51591, to target the Amazon Web Services (AWS) Instance Metadata Service (IMDS) and steal EC2 IAM credentials. The flaw, which has a CVSS score of 6.5, allows threat actors to inject specially crafted HTML iframe elements into Pandoc, enabling them to direct requests to the IMDS endpoint. By leveraging this SSRF vulnerability, attackers can harvest temporary AWS credentials from EC2 instances without requiring direct host access, such as remote code execution or path traversal. The IMDS is a critical AWS component that provides metadata and temporary credentials to applications running on EC2 instances, facilitating secure interactions with other AWS services like S3, RDS, and DynamoDB. The exploitation method involves submitting HTML documents with malicious iframe elements, which, if processed by a vulnerable Pandoc instance on an EC2 host, can access sensitive metadata paths and extract credentials. Security researchers from Wiz highlighted that enforcing IMDSv2, which requires session-based authentication, can effectively block such attacks, as was observed in incidents where IMDSv2 was enabled. Organizations are advised to mitigate this risk by using Pandoc's '-f html+raw_html' or '--sandbox' options and by ensuring IMDSv2 is enforced across all EC2 environments. The attacks underscore the broader risk posed by SSRF vulnerabilities in cloud environments, as they can lead to severe consequences such as network reconnaissance and cloud credential compromise. Resecurity researchers have warned that SSRF flaws, when combined with access to IMDS, can have far-reaching impacts on cloud security. The incident demonstrates that attackers are actively searching for SSRF vulnerabilities in web applications running on EC2 instances to gain unauthorized access to AWS resources. The exploitation of CVE-2025-51591 is not merely theoretical; it has been observed in the wild, with real-world attempts to compromise cloud infrastructure. The incident also highlights the importance of secure application design and the need for defense-in-depth strategies in cloud environments. Security teams are urged to review their use of Pandoc and similar utilities, especially in cloud-hosted environments, to ensure they are not inadvertently exposing sensitive metadata endpoints. The case further illustrates the evolving tactics of threat actors targeting cloud infrastructure through application-layer vulnerabilities. Cloud providers and customers alike must remain vigilant and proactive in patching and securing their environments against such emerging threats. The incident serves as a reminder that even medium-severity vulnerabilities can have significant impact when exploited in the right context. Finally, the coordinated disclosure and analysis by security firms like Wiz have been instrumental in raising awareness and driving mitigation efforts for this vulnerability.
Jun 29, 2026
AWS documented an incident-response scenario in which an attacker exploited a server-side request forgery (SSRF) flaw in an EC2-hosted web application to retrieve temporary credentials for the instance's attached `webdev` IAM role through IMDSv1. The attacker enumerated the role's permissions, established an AWS Management Console session without MFA, pivoted from `us-east-1` to `us-east-2`, and enumerated Amazon Bedrock foundation models. The actor then invoked Amazon Nova Pro through the Converse API, resulting in unauthorized token consumption. The activity was enabled by IMDSv1 exposure, an overprivileged EC2 role with unnecessary cross-Region Bedrock permissions, and missing MFA, with inconsistent regional logging and controls potentially limiting detection. AWS advises remediating the SSRF flaw, requiring IMDSv2 for EC2 metadata access, revoking and investigating use of the compromised role, reviewing CloudTrail across all Regions, restricting Bedrock permissions, and enabling Bedrock model-invocation logging to determine whether prompts or generated outputs were exposed.
Sep 5, 2026
AWS introduced **EC2 Instance Metadata Service Version 2 (IMDSv2)** to reduce theft of instance metadata and IAM role credentials through server-side request forgery (SSRF), open web application firewalls, reverse proxies, and network-device misconfigurations. IMDSv2 requires a session-oriented `HTTP PUT` request to obtain a secret token before metadata access; organizations can enforce IMDSv2-only access or disable IMDS, while AWS provides usage metrics, CloudTrail logging, updated SDKs and CLIs, and the `ec2:RoleDelivery` IAM context key to support migration from IMDSv1. IMDS hardening addresses only one of several credential-access routes available after AWS compute compromise. Attackers may also obtain credentials from hard-coded application secrets, environment variables, local credential files, container credential endpoints, EKS identity mechanisms, and services such as Systems Manager, IoT, IAM Roles Anywhere, Cognito, and DataSync. Security teams should enforce IMDSv2 where applicable and monitor these additional credential stores, endpoints, tokens, and certificates because a single EC2 workload can expose multiple IAM principals.
Sep 3, 2026