Datadog Security Research observed a password spraying campaign against AWS root user accounts from July 24 to August 23, 2026, affecting more than 150 organizations with repeated failed ConsoleLogin attempts. The activity used two distinctive browser user agents and proxy infrastructure, while the attacker’s intent remains unknown. #Datadog #AWS #ConsoleLogin
Keypoints
- The campaign targeted AWS root user accounts across more than 150 organizations between July 24 and August 23, 2026.
- Victims typically saw a median of two failed attempts, with some organizations receiving up to eight attempts.
- Two user agents were repeatedly observed: a Chrome-based Edge string and a Firefox 120 string.
- The authentication traffic was routed through proxies, and source IPs came from many countries and ASNs associated with hosting infrastructure or residential proxies.
- No successful authentication was observed, so the attacker’s intent could not be determined.
- Because AWS root console login requires the account email address, the attacker likely had a list of root emails or brute-forced valid addresses.
- Datadog advises reducing reliance on persistent root credentials, using AWS Organizations controls and centralized root access, and alerting on root activity in CloudTrail.
MITRE Techniques
- [T1110.003 ] Password Spraying – The attackers repeatedly attempted authentication against many AWS root accounts using a small set of credentials/targets over time (‘repeated failed authentication attempts against AWS root user accounts’).
- [T1071.001 ] Web Protocols – The campaign used browser-based console sign-in requests to AWS over standard web login flows (‘ConsoleLogin API call’, ‘AWS sign-in page’).
- [T1090.001 ] Internal Proxy – The authentication traffic was routed through proxy infrastructure to obscure the real origin of the requests (‘Proxies tunneling the authentication requests’).
- [T1589.002 ] Email Addresses – The attacker needed or searched for the email address tied to the AWS root account to generate the login attempt (‘requires the email address associated with the root user account’).
- [T1190 ] Exploit Public-Facing Application – The attacker attempted to access the public AWS sign-in interface exposed to the internet (‘AWS sign-in page’, ‘ConsoleLogin’).
Indicators of Compromise
- [User-Agent ] Browser fingerprints used in the campaign – Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.41, Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- [IP Address ] Example source IP seen in failed login sample and other proxy-originating addresses – 192.0.2.0, and other source IPs across multiple countries and ASNs
- [AWS Event Name ] CloudTrail sign-in activity tied to the campaign – ConsoleLogin, AwsConsoleSignIn
- [AWS Account ID / Principal ID ] Root account identifiers appearing in the sample event – 123456789012
- [AWS Region ] Region shown in the sample sign-in event – us-east-1
Read more: https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign/