AWS: intruder from a CyberStrikeAI host used 8 identities across 4 accounts over 16 days (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-11-13
Elastic Security Labs (published 2026-11-13) describes an intrusion into four AWS accounts over 16 days, with activity on four of those days, carried out through eight identities: five IAM users and three EC2 instance roles. Elastic links the activity to a CyberStrikeAI web interface at one external IP, using an internet-scan fingerprint and the shared source address. It reports no CyberStrikeAI version and says it does not know how the attacker obtained the credentials; server-side request forgery or host compromise are offered only as examples. The most distinctive observation is one server reading 56 EC2 user-data scripts in 141 milliseconds. Elastic reports that count from its logs but does not explain how the timing was measured. Six Elastic detection rules fired on the activity, producing 78 alerts, and between them they covered every phase, so the intrusion was detected rather than evaded. Elastic says it cannot prove that a language model made the decisions, so the AI-agent label is its inference. No CVE or vendor patch applies. The remedy is to audit and rotate IAM credentials and roles, enforce least privilege and short-lived sessions, and correlate CloudTrail across identities and time windows rather than rely on single-rule alerts.
What to do
- Hunt CloudTrail for bursts of same-type calls within seconds (for example, dozens of EC2 user-data reads in one request window) and for activity spread across many roles and identities
- Correlate detections across multiple rules and accounts instead of triaging single-rule alerts in isolation
- Audit and rotate IAM credentials and roles; enforce least privilege and short-lived sessions
- Enable GuardDuty/CloudTrail anomaly detection tuned for automated (non-human) call patterns
- Review whether any CyberStrikeAI-style MCP or AI agent servers are exposed or compromised in your environment
Sources
All live incidents on Threat Watch
