Leaked long-lived AWS creds (Incident)
ID: 090166d5-b292-57eb-ab70-d31b640f2f1b
STIX ID: report--090166d5-b292-57eb-ab70-d31b640f2f1b
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2022-10-07
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
The report documents a compromise of long-lived AWS credentials that allowed unauthorized API access and attempted account creation. Investigation of CloudTrail logs revealed multiple IAM accounts impacted and confirmed leakage of long-lived access keys, with indicators including authentication from outside AWS and a suspicious user-agent ('aws-cli/kali').
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.