Loading story…
Aryon Security disclosed "ShutterGap," a cloud visibility gap that allows attackers to discover and copy briefly exposed public AWS resources before CSPM and CNAPP scans detect them. The issue stems from customer misconfigurations rather than an AWS flaw and affects public-sharing features for resources including Amazon RDS snapshots, Amazon DocumentDB snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager documents. Aryon reported that many exposures are extremely short-lived: about 20% of public RDS snapshots were visible for less than two minutes, and 99% of deleted RDS and DocumentDB snapshots disappeared within 30 minutes of creation.
Researchers showed that once a public snapshot is copied into another AWS account, it can be analyzed later even after the owner revokes access, creating a durable data-exposure risk from fleeting mistakes. In a sample of 24 public RDS snapshots, Aryon found AWS account IDs, email addresses, potential secrets, private-key-related patterns, and signs of financial data; earlier research by Mitiga similarly found hundreds of exposed public RDS snapshots and identified databases containing PII, password hashes, tokens, and business data. The findings underscore that short-lived public sharing can still lead to lasting compromise, and the recommended mitigations include blocking public sharing where possible, enforcing encryption and least privilege, applying Service Control Policies, and monitoring public-sharing events with CloudTrail, AWS Config, and Trusted Advisor.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Aryon Security disclosed the "ShutterGap" cloud visibility gap, describing how briefly exposed public AWS resources can be discovered and copied before security scans detect them. The research said the issue stems from customer misconfigurations affecting resources such as RDS snapshots, DocumentDB snapshots, AMIs, and SSM documents.
In a study running from 2022-09-21 to 2022-10-20, Mitiga observed 2,783 publicly shared Amazon RDS snapshots across regions. After filtering likely intentional or test cases, it identified 650 interesting snapshots and found 171 MySQL databases that potentially contained sensitive information.
As part of the ShutterGap research, Aryon demonstrated that attackers can copy a public snapshot into another AWS account during a brief exposure window and analyze it later even after access is revoked. In a sample of 24 public RDS snapshots, the researchers found sensitive business data including AWS account IDs, email addresses, potential secrets, private-key-related patterns, and indicators of financial data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcearyon.security
Open sourceunit42.paloaltonetworks.com
Open sourcecrowdstrike.com
Open sourcemitiga.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers can exfiltrate data from cloud environments by abusing legitimate cross-account sharing, backup, and replication features instead of moving files over traditional outbound channels. MITRE ATT&CK tracks this behavior as **`T1537` — Transfer Data to Cloud Account**, describing how adversaries use provider APIs and internal cloud networking to make exfiltration resemble normal intra-cloud activity and evade controls focused on internet egress or command-and-control traffic. Research detailing AWS tradecraft shows attackers with snapshot-related permissions can create **Amazon EC2** and **Amazon RDS** snapshots, share them with attacker-controlled AWS accounts, and recover the underlying data without logging back into the original instance or database. Similar abuse is possible in **Amazon S3**, where adversaries can alter replication rules or trigger batch replication jobs to copy bucket contents into external accounts, particularly when overly permissive IAM roles are available. The activity largely occurs through cloud control-plane operations, reducing host-level forensic evidence and increasing the importance of monitoring **CloudTrail**, restricting IAM and KMS permissions, and encrypting sensitive resources.
Aug 15, 2026
Truffle Security reported that more than **9,300 publicly exposed Amazon Web Services access keys** remained active and valid after being leaked between August 2022 and August 2026, highlighting a widespread cloud credential exposure problem. Across public sources, the researchers identified **64,024 unique AWS keys** and found that **88%** of a subset of **10,616** keys with complete credentials still successfully authenticated as of August 10. The leaked secrets included **526 root keys** and **242 IAM user keys** with **`AdministratorAccess`**, creating a path to full AWS account compromise. Researchers said the exposed credentials could allow attackers to steal or destroy data, take control of applications, establish persistence, and deploy cryptominers. **Hugging Face** was identified as the largest single source of leaked AWS keys in the dataset, while the persistence of valid credentials pointed to weak key rotation and poor credential hygiene across affected organizations. Truffle Security urged organizations to delete root access keys, rotate or revoke exposed credentials, review IAM key age and permissions, and enable AWS budget alerts to detect abuse.
Aug 24, 2026
Silver Leaf Technologies' **Worksnaps** client was found to contain hardcoded cloud credentials that exposed the company's production environment, a flaw tracked as **`CVE-2025-10560`** and rated **critical**. Security researchers reported that affected client versions before **`1.6.20260201`** embedded AWS access keys, S3 bucket names, and related cloud access details in application binaries, allowing anyone who obtained the software to extract the secrets. The disclosed credentials reportedly authenticated as the vendor's **AWS root identity**, enabling access to production resources including S3 buckets that stored sensitive user data such as screenshots of employee desktops. SEC Consult said the issue extended beyond the initial embedded keys: after the vendor removed the original hardcoded root credentials, the client still received decryptable AWS credentials from the server during login, leaving access to screenshot buckets effectively unresolved for a period. Researchers also noted additional hardcoded **UCloud** credentials, though their validity was not confirmed. Worksnaps has since released **`1.6.20260201`** as the fixed version, while recommended response actions include immediate credential rotation, restricting or removing sensitive data from exposed buckets, and upgrading all affected clients.
Jun 29, 2026