Skip to content
Threat Feed

Product

AWS Secrets Manager

4 briefs RSS
critical threat

Shai-Hulud Malware Used in Supply Chain Attack via Compromised npm Packages

The Shai-Hulud malware was used in a large-scale software supply-chain attack compromising hundreds of packages across open-source software ecosystems by compromising developer secrets and CI/CD pipelines.

router +11 TeamPCP supply-chain supply-chain-attack npm pypi credential-theft shai-hulud
3r 7t 3i
medium advisory

AWS Secrets Manager Rapid Secrets Retrieval Attempts

Compromised AWS credentials may be used to rapidly retrieve multiple secrets from AWS Secrets Manager in order to escalate privileges or move laterally within the environment.

AWS Secrets Manager aws credential-access secrets-manager
2r 1t
high advisory

Multiple Cloud Secrets Accessed by Source Address

A single source IP accessing secret-management APIs across multiple cloud providers (AWS, GCP, Azure) and Kubernetes clusters within a short timeframe indicates credential theft or token replay for secret harvesting.

AWS Secrets Manager +3 cloud credential-access kubernetes
2r 1t
medium advisory

First Time Seen AWS Secret Value Accessed in Secrets Manager

This rule detects the first time a specific user identity has programmatically retrieved a secret value from AWS Secrets Manager using the GetSecretValue action, which may indicate a compromised AWS service attempting to access secrets.

AWS Secrets Manager cloud aws credential-access
2r 1t