AWS Cyberattack Exposes Millions of Website Credentials

A large-scale cyberattack targeting misconfigured Amazon Web Services (AWS) instances has exposed sensitive data across millions of websites. The breach, attributed to French-speaking threat actors potentially linked to the ShinyHunters and Nemesis groups, resulted in the theft of AWS customer keys, database credentials, and proprietary source code. Security researchers uncovered that the attackers not only leveraged customer-side vulnerabilities but also stored the stolen data in an unprotected AWS S3 bucket, effectively creating a shared repository for malicious use.

The methodology involved systematic scanning of the internet for misconfigured cloud instances (T1595.002). Upon exploitation, the actors exfiltrated a diverse range of credentials—including those for Twilio, Binance, SendGrid, and GitHub—which were subsequently sold via a dedicated Telegram channel for profit. AWS has stated that the incident was not due to a system-wide vulnerability but rather a failure by customers to adhere to the shared responsibility model, highlighting the critical nature of cloud security posture management.

This campaign represents a significant risk to intellectual property and service integrity. Affected organizations face potential downstream attacks including database breaches, supply chain compromise via stolen Git credentials, and fraudulent communication through compromised SMTP and SMS API keys.