←back to thread

Ask HN: Our AWS account got compromised after their outage

391 points kinj28 | 1 comments | 21 Oct 25 15:55 UTC | HN request time: 0.201s | source

Could there be any link between the two events?

Here is what happened:

Some 600 instances were spawned within 3 hours before AWS flagged it off and sent us a health event. There were numerous domains verified and we could see SES quota increase request was made.

We are still investigating the vulnerability at our end. our initial suspect list has 2 suspects. api key or console access where MFA wasn’t enabled.

Show context
timdev2 ◴[21 Oct 25 17:03 UTC] No.45658257[source]▶
I would normally say that "That must be a coincidence", but I had a client account compromise as well. And it was very strange:

Client was a small org, and two very old IAM accounts had suddenly had recent (yesterday) console log ins and password changes.

I'm investigating the extent of the compromise, but so far it seems all they did was open a ticket to turn on SES production access and increase the daily email limit to 50k.

These were basically dormant IAM users from more than 5 years ago, and it's certainly odd timing that they'd suddenly pop on this particular day.

replies(3): >>45659427 #>>45663754 #>>45672001 #
tcdent ◴[21 Oct 25 18:13 UTC] No.45659427[source]▶
Smells like a phishing attack to me.

Receive an email that says AWS is experiencing an outage. Log into your console to view the status, authenticate through a malicious wrapper, and compromise your account security.

replies(4): >>45659478 #>>45659699 #>>45664258 #>>45665835 #
1. highfrequencyy ◴[22 Oct 25 02:25 UTC] No.45664258[source]▶
I second this, pretty much immediately after my organization got hit with a wave of phishing emails.