CyberStrikeAI server used stolen AWS credentials across four accounts
Original title: 56 AWS API calls in 141 milliseconds: Inside an AI-run intrusion
One IP raised 78 medium or low alerts from September 30 to October 16, including 56 EC2 user-data reads in 141 milliseconds.
Elastic Security Labs says a server it attributes to the open-source CyberStrikeAI platform used stolen credentials for eight AWS identities across four accounts between September 30 and October 16, 2026. The activity validated identities, read Secrets Manager and EC2 user data, decrypted an SSM parameter, and issued an SSM SendCommand. Elastic calls it AI-assisted from tool attribution and machine-speed logs, but cannot show an LLM chose the actions or how the credentials were obtained. Related IPs on port 8080 shared a self-signed certificate; none still served the interface as of November.
Unconfirmed: Elastic cannot prove an LLM made decisions and does not know how the credentials were stolen.
- Source IP 43.240.29.11 was tied to a CyberStrikeAI page on port 8080 before the first alert.
- app-role sent 56 user-data requests in 141 milliseconds; user-data alerts were 74% of the total.
- On October 2, container-role read an encrypted SSM parameter and sent a command 29 seconds later.
- Activity spanned four active days inside a 16-day window, with a 14-day quiet gap.
- Two related IPs, 43.240.29.28 and 43.240.29.33, shared the same self-signed certificate.
Impact: Stolen AWS credentials used to read secrets and send commands
- 1.Hunt retrospectively for 43.240.29.11, 43.240.29.28, and 43.240.29.33.
- 2.Correlate low-severity CloudTrail alerts by source IP across multi-week gaps.
- Vendors
- Amazon Web Services
- Products
- AWSCyberStrikeAI
- Organizations
- Elastic Security LabsTeam CymruSonderCloud Limited
- Countries
- Hong Kong
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 43.240.29.11 | Between Sep 30 and Oct 16, 2026, one CyberStrikeAI server (43[.]240[.]29[.]11) used credentials from eight AWS identities (five IAM |
| ipv4 | 43.240.29.28 | does not show what the command was or whether it succeeded. 43[.]240[.]29[.]28 and 43[.]240[.]29[.]33 serve a CyberStrikeAI page on |
| ipv4 | 43.240.29.33 | command was or whether it succeeded. 43[.]240[.]29[.]28 and 43[.]240[.]29[.]33 serve a CyberStrikeAI page on port 8080 with the same |
From the original article
12 min read at elastic.co
A CyberStrikeAI server spent 16 days in four AWS accounts using eight identities, and the CloudTrail record shows why six detection rules each caught only part of it.
By Samir Bousseaden,Bryan Porras Blanch,Terrance DeJesus · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.