# CyberStrikeAI: 56 AWS API calls in 141 milliseconds from one server

> CyberStrikeAI left a machine-speed trail in AWS CloudTrail that Elastic turned into two new detection rules.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** Elastic Security Labs
- **Disclosed:** 2026-11-13
- **Affects:** CyberStrikeAI, Amazon Web Services, AWS Secrets Manager, AWS Systems Manager, Amazon EC2
- **Research by:** Samir Bousseaden, Bryan Porras Blanch, Terrance DeJesus
- **Primary source:** https://www.elastic.co/security-labs/threat-command/cyberstrikeai-aws-cloudtrail-intrusion
- **Page:** https://theinjection.dev/items/elastic-cyberstrikeai-aws-cloudtrail/

Elastic Security Labs traced one CyberStrikeAI server using credentials from eight AWS identities across four accounts over 16 days, including a burst of 56 DescribeInstanceAttribute calls in 141 milliseconds.

## What happened

Elastic Security Labs published an analysis on November 13, 2026 of a single CyberStrikeAI server at 43.240.29.11 that used credentials belonging to eight AWS identities across four accounts. Activity ran from September 30 to October 16, 2026 and produced 78 alerts. Samir Bousseaden, Bryan Porras Blanch and Terrance DeJesus wrote the report.

## How it works

CyberStrikeAI is an open-source platform that pairs LLM agents with offensive security tools. The server first validated stolen credentials with GetCallerIdentity, then read a secret from Secrets Manager and swept EC2 user data, where hardcoded credentials often sit. On October 2 a container role decrypted an SSM SecureString parameter and issued an SSM SendCommand 29 seconds later. The authors state they cannot prove an LLM agent made the decisions, and rest the attribution on the tooling and on machine-speed timing.

## Who is affected

AWS accounts with leaked IAM user keys or exposed EC2 instance role credentials are in scope, especially accounts that keep secrets in EC2 user data. The campaign touched five IAM users and three instance roles across four accounts, on four active days spread over 16.

## What to do

Rotate credentials and revoke active sessions for any identity that touched the indicator address, replace instance profiles or instances for compromised roles, and move secrets out of EC2 user data into Secrets Manager or Parameter Store. Restrict ec2:DescribeInstanceAttribute, review SSM command history for unexpected SendCommand calls, and check whether non-production roles overlap with production secrets.

## Quick facts

- **Attack type:** Credential validation, secret collection and remote command execution in AWS
- **Campaign window:** September 30 to October 16, 2026, across four active days
- **Identities:** Eight in four AWS accounts: five IAM users and three EC2 instance roles
- **Peak burst:** 56 DescribeInstanceAttribute calls in 141 milliseconds, about 2.5 ms each
- **Alerts:** 78 in total, 58 of them user data retrieval
- **Found by:** Samir Bousseaden, Bryan Porras Blanch and Terrance DeJesus, Elastic Security Labs
- **Detection:** Two new high-severity ES|QL rules for bulk user data reads and bulk GetCallerIdentity

## Sources

1. [Elastic Analysis](https://www.elastic.co/security-labs/threat-command/cyberstrikeai-aws-cloudtrail-intrusion)
2. [Elastic Frameworks](https://www.elastic.co/security-labs/threat-command/agentic-offensive-frameworks-detection-artex)
3. [Kaspersky Report](https://securelist.com/cyberstrikeai-attacks/121715/)