Cybercrime Gangs Abscond With Thousands of Orgs' AWS Credentials

Researchers uncovered a mass cybercrime campaign in which attackers scanned millions of public web endpoints to find and exploit application-side vulnerabilities and misconfigurations in AWS-hosted assets, harvesting AWS keys, infrastructure credentials, source code, databases and other secrets from thousands of organizations; the operation used automated tooling (including Shodan lookups and product-specific endpoint extraction), has ties to Nemesis/ShinyHunters, and was partially exposed when the attackers stored stolen data and tools in a misconfigured 2TB S3 bucket, which researchers reported to AWS and Israeli authorities.