CyberStrikeAI: 56 AWS API calls in 141 milliseconds from one server

01What happened

Elastic Security Labs published an analysis on November 13, 2026 of a single CyberStrikeAI server at 43.240.29.11 that used credentials belonging to eight AWS identities across four accounts. Activity ran from September 30 to October 16, 2026 and produced 78 alerts. Samir Bousseaden, Bryan Porras Blanch and Terrance DeJesus wrote the report.

02How it works

CyberStrikeAI is an open-source platform that pairs LLM agents with offensive security tools. The server first validated stolen credentials with GetCallerIdentity, then read a secret from Secrets Manager and swept EC2 user data, where hardcoded credentials often sit. On October 2 a container role decrypted an SSM SecureString parameter and issued an SSM SendCommand 29 seconds later. The authors state they cannot prove an LLM agent made the decisions, and rest the attribution on the tooling and on machine-speed timing.

03Who is affected

AWS accounts with leaked IAM user keys or exposed EC2 instance role credentials are in scope, especially accounts that keep secrets in EC2 user data. The campaign touched five IAM users and three instance roles across four accounts, on four active days spread over 16.

04What to do

Rotate credentials and revoke active sessions for any identity that touched the indicator address, replace instance profiles or instances for compromised roles, and move secrets out of EC2 user data into Secrets Manager or Parameter Store. Restrict ec2:DescribeInstanceAttribute, review SSM command history for unexpected SendCommand calls, and check whether non-production roles overlap with production secrets.

Sources 3 links, all fetched

1. 1elastic.coElastic Analysis
2. 2elastic.coElastic Frameworks
3. 3securelist.comKaspersky Report