FortiGuard Labs Links New EC2 Grouper Hackers to AWS Credential Exploits

Researchers from FortiGuard Labs tracked an actor named EC2 Grouper that steals AWS credentials (often from code repositories) and uses API-driven activity and AWS tooling to create resources and persist in cloud environments; the group leaves weak but recurring indicators such as security group naming patterns and user agents, making detection challenging and prompting recommendations to use CSPM, secret-scanning alerts, and anomaly detection to identify credential misuse and unusual API activity.