What the June 2026 Threat Technique Catalog update means for your AWS environment

AWS CIRT’s June 2026 Threat Technique Catalog update highlights five new techniques and three refreshed entries emphasizing attacks against container orchestration (notably EKS) and abuse of organization-level trust. Key risks include in-place modification of running workloads, exploitation of public-facing pods, cross-account root assumption (sts:AssumeRoot) enabling full control of member accounts, large-scale compute hijacking for cryptomining, and malicious invitations to attacker-controlled organizations; the catalog maps detections and mitigations (CloudTrail/Kubernetes audit guidance, RBAC, admission controllers, SCPs, GuardDuty EKS Protection, resource quotas, and registry restrictions).