AI-ASSISTED CLOUD INTRUSION ACHIEVES ADMIN ACCESS IN 8 MINUTES

Summary from the TLDR InfoSec newsletter

In November 2025, the Sysdig Threat Research Team (TRT) detected an account compromise that was notable for the attacker's 8-minute progression from initial access to administrative privileges, using LLM assistance. The attacker gained initial access through credentials discovered in a public S3 bucket. They then used these credentials to replace the Lambda function code to escalate privileges, move laterally across 19 different principals, and finally harvest sensitive data. They also used Bedrock to access cloud-hosted LLMs and launch GPU instances for model training. The article includes mitigation recommendations for each step in the attacker's exploit chain.