AI-Assisted Hackers Compromise AWS Cloud in 72 Hours Using Stolen Credentials

An AI-assisted threat actor rapidly compromised a modern AWS environment in roughly 72 hours by exploiting an exposed access key, automating reconnaissance and credential harvesting, pivoting through permissive roles, and persisting via IAM backdoors and modified deployments. The attacker accessed ECS/EC2, S3, RDS, CI/CD runners, and source control to exfiltrate data and prepare extortion, with activity aligning to known MITRE ATT&CK techniques and investigated by Sygnia.