Amazon security boss blames Russia's GRU for years-long energy-sector hacks

Amazon Threat Intelligence attributes a multi-year GRU campaign (2021–present) targeting Western energy, telecommunications, and technology providers. Attackers prioritized misconfigured AWS-hosted network edge virtual appliances and exploited known CVEs (including WatchGuard CVE-2022-26318 and Confluence CVEs) to gain persistence on EC2 instances, conducted credential-replay likely via packet capture, and attempted access to collaboration and cloud project-management platforms; Amazon reports continual disruption of operations, customer remediation, and guidance to perform edge audits, authentication-log reviews, and monitoring for anomalous appliance admin access.