Search: “AWS root user”

9 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 56 Malware 27 Exploit / PoC 22 Ransomware 20 Industry 18 Data breach 17 Policy & legal 10 Threat actor 9 AI industry 8 AI tools & infra 6 AI research 5 Tools 5 AI safety & security 4 Phishing & fraud 4

SeverityAll critical 90 high 48 medium 41 low 12 info 28

Password spraying campaign targets AWS root user accounts across 150+ organizations

Datadog researchers observed a password spraying campaign attempting to authenticate as AWS root users across 150+ organizations.

Datadog Security Research observed a large-scale password spraying campaign attempting to authenticate as AWS root user accounts across more than 150 organizations. The campaign targeted root credentials rather than standard IAM users, and no confirmed compromises are stated in the report. Root account access would grant full control of affected AWS environments, making this a significant credential-attack campaign for cloud defenders.

Datadog Security LabsAug 31, 00:00 UTC · 17d agoThreat actor in the wild

AWS Mandates Multi

Infosecurity MagazineOct 6, 12:00 UTC · Oct 6, 2023Threat actor

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.

The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.

The Hacker NewsAug 28, 08:05 UTC · 19d agoThreat actor in the wildCVE-2026-194781

Hundreds of Docker Hosts compromised in cryptojacking campaigns

Security AffairsMar 5, 12:13 UTC · Mar 5, 2019Threat actor CVE-2019-57361

Cryptojacking campaign relies on DevOps tools

Security AffairsJun 3, 07:17 UTC · Jun 3, 2025Threat actor CVE-2020-141442

New Horabot campaign targets the Americas

Cisco TalosJun 1, 12:00 UTC · Jun 1, 2023Threat actor

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point ResearchSep 2, 10:16 UTC · 14d agoThreat actor

Iranian Hackers Pose as Recruiters to Deliver Cross

Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.

Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.

The Hacker NewsSep 2, 10:20 UTC · 14d agoThreat actor

⚡ Weekly Recap: Lazarus Hits Web3, Intel/AMD TEEs Cracked, Dark Web Leak Tool & More

The Hacker NewsNov 3, 17:59 UTC · Nov 3, 2025Threat actor CVE-2025-61932 CVE-2025-55315 CVE-2025-10680+18 CVEs1