Observed incident
Elastic links a CyberStrikeAI server to credential abuse across four AWS accounts
Reported
Published here
What happened
Elastic traced activity from a CyberStrikeAI server to eight AWS identities between September 30 and October 16. The actor used stolen credentials to read cloud secrets and instance configuration data. Elastic correlated 78 alerts across four accounts.
Parties and reporting
Where this happened
Victim location not disclosed. Real organizations or systems were affected or targeted, but the sources do not say where. Explore the world map.
AI tools and systems: CyberStrikeAI, AWS Identity and Access Management, AWS CloudTrail
Outcome
Cloud audit logs recorded a remote command request after an encrypted parameter was read. The logs do not show the command contents or whether it ran successfully. The source gives no recovery date for the accounts.
Operating lesson
Review cloud activity across identities and accounts when it comes from the same unexpected source. Include earlier activity when credentials reappear after a long gap.
Evidence and limits
November 13 is the public research date. Elastic ties the infrastructure to CyberStrikeAI and assesses AI assistance from the tooling and automation. It could not determine how the credentials were stolen or prove an LLM chose the actions. Four accounts do not establish four distinct victim organizations.