Hackers Using AI to Get AWS Admin Access Within 10 Minutes

Researchers observed an AI-assisted AWS compromise where attackers discovered credentials in public S3 RAG data, used LLMs to automate reconnaissance and generate malicious Lambda updates, escalated privileges to an admin account, created a backdoor admin user, invoked multiple foundation models on Amazon Bedrock (LLMjacking), and provisioned an expensive GPU EC2 instance for persistent access and model hosting; the report includes an execution timeline, multiple IP indicators of compromise, signs of AI-generated artifacts, and recommended mitigations such as least-privilege enforcement, restricting Lambda and PassRole permissions, S3 hardening, and enabling model invocation logging.