Loading story…
Palo Alto Networks Unit 42 presented a method for identifying the functional roles of AWS cloud identities from AWS CloudTrail activity rather than IAM permissions or naming conventions. Across more than 40,000 identities in 125 cloud environments observed over two months, the researchers found repeatable behavioral groups representing administrators, DevOps teams, CI/CD systems, security tools, backup agents, networking components, and FinOps platforms.
The pipeline transforms invoked AWS API operations into sparse Boolean vectors, uses UMAP for dimensionality reduction, and applies HDBSCAN to group identities and surface outliers. One administrator-console cluster contained roughly 5,000 identities, about 94% of which used ConsoleLogin, versus under 1% in other clusters; Unit 42 proposes converting selected clusters into sparse L1-regularized logistic-regression classifiers deployable in SQL to flag deviations such as a backup identity executing administrative actions.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Unit 42 published research describing behavioral clustering of AWS CloudTrail activity to infer cloud identities' functional roles. The study analyzed more than 40,000 identities across 125 cloud environments over a two-month period and proposed SQL-deployable classifiers for role inference and anomaly detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wiz documented **Console Conceal**, a technique in which an attacker with stolen IAM-user credentials and permission to call `AssumeRole` selects an arbitrary role-session name and creates a federated AWS Management Console session. CloudTrail records subsequent console activity under a derived temporary access key rather than the access key issued in the initiating `AssumeRole` event, frustrating direct access-key correlation between the activity and the compromised IAM principal. AWS organizations should require and monitor **SourceIdentity** on role assumptions, as it propagates an administrator-controlled, immutable identity into subsequent CloudTrail events. For historical sessions without SourceIdentity, investigators can correlate suspicious console events to role assumptions using the role name, role-session name, and session-creation timing, while reviewing CloudTrail `userIdentity` fields and tightening IAM permissions that permit role assumption and custom identity-broker console access.
Sep 3, 2026
Palo Alto Networks Unit 42 reported that exposed AWS IAM access keys were used in malicious operations that rapidly turned compromised cloud accounts into platforms for **cryptojacking** and broader resource abuse. Attackers leveraged valid IAM credentials to gain access without exploiting software flaws, then provisioned compute resources and manipulated cloud services to mine cryptocurrency while consuming victims’ infrastructure and budget. The activity highlights how leaked cloud credentials can enable fast, low-friction compromise across internet-facing environments, especially when keys are overprivileged or insufficiently monitored. Unit 42’s findings underscore that exposed IAM keys can support sustained unauthorized operations inside cloud tenants, making credential hygiene, least-privilege access, key rotation, and continuous monitoring of anomalous cloud activity critical defensive measures.
Jul 12, 2026
AWS published a reference architecture for **Amazon Bedrock AgentCore** that limits AI agents to the requesting user’s permissions by propagating end-user authorization context to downstream services instead of enforcing access control in agent code. In the design, users authenticate through **Amazon Cognito**, custom claims such as department are added to JWTs, and **AgentCore Runtime** validates those claims before the agent runs. AWS said this approach reduces the risk of unauthorized data exposure from prompt injection or application bugs because the agent acts as an orchestrator rather than a trusted gatekeeper. The architecture demonstrates three enforcement patterns across common enterprise data sources: user-scoped temporary AWS credentials for **Amazon DynamoDB** using `STS AssumeRoleWithWebIdentity` and session tags, metadata-based filtering for **Amazon Bedrock Knowledge Bases**, and OAuth 2.0 on-behalf-of token exchange for **Salesforce** through AgentCore Identity. In the example CRM workflow, Sales and Finance employees can use the same agent while only receiving records allowed by their own roles, with AWS also recommending stronger isolation such as separate knowledge bases and IAM policies where stricter separation is required.
Aug 20, 2026