AWS customers face massive breach amid alleged ShinyHunters regroup

Terabytes of data belonging to thousands of AWS customers, including customer details, AWS credentials, and proprietary source code, were compromised in a large-scale cyber operation linked to the now-defunct ShinyHunters hacking group.

Independent cybersecurity researchers, Noam Rotem and Ran Locar, found the operation exploiting vulnerabilities and misconfigurations in a number of public sites to gain unauthorized access to sensitive data.

“We have identified a significant operation that scanned millions of websites, exploiting vulnerabilities in improperly configured public sites,” said researchers from vpnMentor, the cybersecurity research firm that collaborated with Rotem and Locar to publish a report on the findings. “This incident resulted in the exposure of sensitive keys and secrets, granting unauthorized access to customer data.”

The report noted that a “sophisticated and extensive” infrastructure designed by French-speaking threat actors was used to conduct comprehensive scans of the internet for detecting exploitable vulnerabilities.

“All services are operating as expected,” an AWS spokesperson said. “AWS credentials include secrets that must be handled securely. AWS provides capabilities which remove the need to ever store these credentials in source code. For example, AWS Secrets Manager helps you manage, retrieve, and rotate database credentials, API keys, and other secrets throughout their lifecycles. Customers still sometimes inadvertently expose credentials in public code repositories. When AWS detects this exposure, we automatically apply a policy to quarantine the IAM user with the compromised credentials to drastically limit the actions available to that user, and we notify the customer. If a customer’s credentials are compromised, we recommend they revoke the credentials, check AWS CloudTrail logs for unwanted activity, and review their AWS account for any unwanted usage.”

A hacker goof-up gave away the operation

The S3 bucket attackers used to store the data stolen from the victims had, ironically, a misconfiguration which resulted in it being open to analysis by the researchers.

“The S3 bucket was being used as a ‘shared drive’ between the attack group members, based on the source code of the tools used by them,” the researchers said.

The code in the S3 bucket revealed that the breach involved discovery and exploitation, starting with AWS IP ranges expanded into domain lists via Shodan and SSL certificate analysis. Scans then targeted exposed endpoints and system types, extracting data like database credentials and AWS keys.

Attackers deployed custom scripts, including Python and PHP, to exploit open-source tools like Laravel to harvest credentials, including Git, SMTP, and cryptocurrency keys. Verified credentials were stored for later use, and remote shells were installed for deeper access when needed.

AWS keys were tested for access to IAM, SES, SNS, and S3 services, enabling attackers to establish persistence, send phishing emails, and steal sensitive data. AI service keys were notably excluded, likely due to outdated tools or limited value.

“We originally discovered the operation in August of 2024, and on September 26, we sent the report to AWS Security, since most of the victims targeted by the attack were AWS customers,” the researchers said in the report. “They began to take immediate actions to mitigate the impact and alert the affected customers of the risk.”

Researchers highlighted that the misconfigurations enabling this attack fall under customers’ responsibilities within the shared responsibility model and could happen with any Cloud Service Provider (CSP).

On November 9, the AWS security team confirmed the complete handling of the issue.

Evidence points to a ShinyHunters regroup

The attack infrastructure, that Rotem and Locar stumbled upon, revealed the code used by the attackers along with the potential identities of a few people behind it.

“While the group conducts its business under a different name, ‘Nemesis,’ we were also able to connect some of the activity to the now defunct attack group ‘Shiny Hunters,’” the researchers said.

ShinyHunters is a notorious hacking group known for running BreachForums with Baphomet before it was decommissioned by a law enforcement seizure in May.

While no ShinyHunters activity was reported since, BreachForums was revived shortly after, possibly under a new administration by prominent hackers like IntelBroker.

“The operators use tools which appear to be the same as those used by the ‘ShinyHunters’ hacking group,” researchers said, adding that the tools are documented in French and signed by “Sezyo Kaizen.” The alias has been linked to Sebastien Raoult, a ShinyHunters member, who was arrested and extradited to the US and pleaded guilty in January 2024 to charges of conspiracy to commit wire fraud and aggravated identity theft.