Research has discovered a password-spraying campaign targeting AWS root user accounts across more than 150 organizations. This highlights ongoing efforts by attackers to compromise the most privileged identities in cloud environments.
The campaign ran from July 24 to August 23, 2026, and involved multiple failed authentication attempts against AWS root accounts. Most affected organizations recorded a median of two attempts. In comparison, some experienced as many as eight attempts during the month-long activity period.
Datadog Security Researchers have not identified any successful logins associated with this campaign, leaving the attackers’ ultimate objective unclear.
However, compromising an AWS root account could grant an intruder unrestricted access to an organization’s cloud resources, billing data, account configurations, and other sensitive administrative functions.
The observed activity utilized a broad, proxy-backed infrastructure to tunnel authentication requests. Source IP addresses were spread across numerous countries and autonomous systems, with threat intelligence services classifying them as hosting infrastructure, residential proxies, or similar anonymization services.
This architecture makes IP-based blocking less effective and complicates attribution. Furthermore, Datadog did not find any obvious pattern in the victimology: the targeted organizations operated across various industries and geographic regions, suggesting opportunistic targeting rather than a campaign focused on a specific sector.
Two browser user-agent strings were consistently associated with the login attempts:
A notable characteristic of this activity is that a failed AWS ConsoleLogin event for the root user requires the email address tied to that account.
This suggests that the threat actor may already possess a list of root account email addresses, potentially gathered from prior breaches, exposed records, open-source intelligence (OSINT) collection, or credential datasets.
Alternatively, the attackers could be testing a broader list of known corporate email addresses until they identify accounts registered as AWS root users.
Using password spraying, testing a limited number of passwords across many accounts, allows attackers to evade conventional account-lockout controls typically associated with high-volume brute-force attacks.
AWS root users are particularly valuable targets because they hold complete authority over an account. Although AWS enforces multi-factor authentication (MFA) for root users and recommends monitoring all root activity, attackers may still target accounts where MFA enrollment is incomplete, recovery workflows are weak, or credentials have been previously exposed.
Security teams should review AWS CloudTrail logs for root ConsoleLogin events, both failed and successful attempts. A targeted query should filter for userIdentity.type:Root, eventName:ConsoleLogin, failed authentication results, and the identified Chrome/Edge and Firefox user agents.
Organizations should also set up alerts for:
To reduce exposure, enterprises should eliminate persistent root user access wherever possible. The AWS Organizations service control policies can restrict direct root actions in member accounts.
In contrast, centralized root access can support short-lived AssumeRoot sessions for exceptional administrative tasks. Management-account root credentials require separate, tightly controlled protections.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…