{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/identity-audit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS Security Token Service (STS)","AWS CloudTrail"],"_cs_severities":["low"],"_cs_tags":["cloud","aws","persistence","identity-audit"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAdversaries targeting AWS environments may attempt to register new Multi-Factor Authentication (MFA) devices against compromised IAM identities to secure long-term access. By leveraging the AWS Security Token Service (STS) \u003ccode\u003eAssumeRole\u003c/code\u003e, \u003ccode\u003eAssumeRoleWithSAML\u003c/code\u003e, or \u003ccode\u003eAssumeRoleWithWebIdentity\u003c/code\u003e APIs, an attacker with valid but potentially limited credentials can perform privilege escalation or lateral movement. The registration of a new MFA device serves as a mechanism to bypass or supersede existing authentication requirements, granting the adversary persistent access to the assumed role's permissions. Defenders should monitor CloudTrail for successful role assumptions that reference previously unseen MFA serial numbers, as this pattern often deviates from standard administrative workflows or automated service account behavior.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a set of AWS IAM credentials (e.g., via hardcoded keys, leaked environment variables, or SSRF).\u003c/li\u003e\n\u003cli\u003eThe attacker uses the compromised credentials to query current IAM user permissions and MFA device configurations.\u003c/li\u003e\n\u003cli\u003eThe attacker registers a new, attacker-controlled MFA device (e.g., virtual MFA) to the compromised IAM user account via \u003ccode\u003eCreateVirtualMFADevice\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker associates the new MFA device with the target IAM role or user using \u003ccode\u003eEnableMFADevice\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker executes \u003ccode\u003eAssumeRole\u003c/code\u003e or a related STS action, providing the new MFA serial number in the request parameters.\u003c/li\u003e\n\u003cli\u003eAWS validates the new MFA token, and the attacker receives temporary security credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the elevated temporary session credentials to access, exfiltrate, or manipulate AWS resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an adversary to maintain persistent access to an AWS account, escalate privileges beyond the initial scope, and move laterally across different accounts or services. This activity can lead to unauthorized data exfiltration, service disruption, or total account takeover depending on the IAM policies attached to the assumed role.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize monitoring of AWS CloudTrail logs for unusual \u003ccode\u003eAssumeRole\u003c/code\u003e events. Establish a baseline for normal MFA registrations and role assumptions to reduce false positives from legitimate administrative tasks.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement alerts for successful \u003ccode\u003eAssumeRole\u003c/code\u003e events where the \u003ccode\u003erequest_parameters.serialNumber\u003c/code\u003e field is present and indicates a newly registered device.\u003c/li\u003e\n\u003cli\u003eReview all MFA device registration events (e.g., \u003ccode\u003eCreateVirtualMFADevice\u003c/code\u003e) alongside \u003ccode\u003eAssumeRole\u003c/code\u003e activity to identify unauthorized additions.\u003c/li\u003e\n\u003cli\u003eRevoke temporary credentials immediately if a role assumption is linked to an unauthorized MFA device registration.\u003c/li\u003e\n\u003cli\u003eAudit IAM policies to ensure that only authorized users have the permission to manage their own MFA devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:41:30Z","date_published":"2026-09-18T19:41:30Z","id":"https://feed.craftedsignal.io/briefs/2026-09-aws-sts-mfa-persistence/","summary":"Adversaries may register new MFA devices for compromised AWS IAM roles to maintain persistence, escalate privileges, or facilitate lateral movement by assuming roles via the AWS Security Token Service (STS).","title":"AWS STS AssumeRole with New MFA Device","url":"https://feed.craftedsignal.io/briefs/2026-09-aws-sts-mfa-persistence/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Amazon Bedrock"],"_cs_severities":["high"],"_cs_tags":["cloud","llm","aws","llmjacking","identity-audit"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eLLMjacking involves threat actors gaining access to cloud environments and utilizing stolen long-term IAM credentials (AKIA* access keys) to abuse AI services. In the context of Amazon Bedrock, attackers prioritize identifying available foundation models for potential exploitation to run high-volume or high-cost model inference. This activity is notable because legitimate production workloads utilizing Bedrock typically operate under temporary IAM roles, making the use of long-term user keys for discovery and invocation highly irregular. Defenders should monitor for patterns where the same access key performs enumeration followed immediately by model invocation. This activity indicates a potential compromise of IAM credentials and an attempt to leverage the organization's cloud resources for unauthorized AI model consumption at the account owner's expense.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eLLMjacking can result in significant financial impact due to high-volume model inference costs. Furthermore, it indicates that a threat actor has successfully gained Initial Access via compromised credentials, potentially allowing for broader exploitation of other AWS services such as S3 or Secrets Manager if the IAM user has excessive permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor AWS CloudTrail logs for the sequence of ListFoundationModels followed by InvokeModel, InvokeModelWithResponseStream, Converse, or ConverseStream by the same access key within 15 minutes.\u003c/li\u003e\n\u003cli\u003ePrioritize auditing of all existing long-term IAM user access keys, enforcing rotation, and migrating Bedrock workloads to IAM roles with short-lived credentials.\u003c/li\u003e\n\u003cli\u003eInvestigate the source IP and user agent associated with any long-term key performing Bedrock operations to identify potential unauthorized access or credential exposure.\u003c/li\u003e\n\u003cli\u003eRestrict the usage of long-term keys for AI services through Service Control Policies (SCPs) where business requirements permit.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:29:20Z","date_published":"2026-09-18T19:29:20Z","id":"https://feed.craftedsignal.io/briefs/2026-09-llmjacking-bedrock/","summary":"Adversaries are abusing stolen long-term AWS IAM access keys to perform unauthorized reconnaissance and high-cost model inference within Amazon Bedrock.","title":"LLMjacking via Compromised AWS Long-Term IAM Credentials","url":"https://feed.craftedsignal.io/briefs/2026-09-llmjacking-bedrock/"}],"language":"en","title":"CraftedSignal Threat Feed - Identity-Audit","version":"https://jsonfeed.org/version/1.1"}