Hackers Exploited Misconfigured AWS .env Files to Attack 110,000 Domains

**Executive Summary:** Attackers exploited publicly exposed .env files to harvest hard-coded AWS IAM credentials, enabling access to victim AWS environments, privilege escalation via creation of AdministratorAccess IAM roles, and deployment of Lambda functions to scan for and exfiltrate S3 data for extortion; the campaign scanned ~230 million targets across ~110,000 domains and extracted ~90,000 unique variables. Indicators include numerous flagged IPs (Tor exit nodes, VPS and VPN endpoints) and a SHA256 for a Lambda.sh script; recommended mitigations emphasize secrets management, least-privilege IAM, encryption, secure configuration practices, and comprehensive monitoring.