Password spraying campaign targets AWS root user accounts across 150+ organizations
Datadog observed a password-spraying campaign targeting AWS root users across 150+ organisations — a reminder that the most privileged cloud identity is often the least monitored.
Summary written by editorial AI · Source link below
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations.
Editorial Analysis
AWS root accounts carry unrestricted power over entire tenancies; a broad spray campaign proves adversaries are betting many organisations still neglect MFA and monitoring for this identity.
Immediately audit all AWS root accounts for hardware MFA enforcement, enable CloudTrail alerting on any root login attempt, and restrict root access via SCPs.
Attackers are systematically probing AWS root accounts across 150+ organisations — any unprotected root account could give full control of your cloud environment.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Datadog Security Labs in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d