Skip to content
Threat Feed
Subscribe

Product

Amazon SageMaker

1 brief RSS
high advisory

AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content

This brief details how attackers can leverage compromised AWS credentials to inject malicious, base64-encoded scripts into Amazon SageMaker notebook lifecycle configurations, which then execute as root on notebook instances, enabling persistence, credential theft, or further compromise of the AWS environment.

Amazon SageMaker cloud aws sagemaker persistence execution backdoor credential-theft
2t