Total Cloud Insights: Protect Your AWS Environment by Managing Access Keys Securely | Qualys
Summary: Qualys documented an AWS access key theft that began with a security alert on an unfamiliar Kali Linux user agent, aws-cli/1.22.34 Python/3.9.11 Linux/5.15.0-kali3-amd64 botocore/1.27.84, and led investigators to three denied API calls from the same key under different user agents. The investigation found seven compromised AWS IAM accounts and access keys, all traced back to a publicly exposed Postman server that stored access key credentials, with the attacker's IP allocated to a hosting provider outside AWS, Google, and Microsoft and located atypically for the customer.
Key Takeaway: Seven access keys were compromised because one Postman server was left publicly exposed with credentials stored in it, and the attacker's activity centered on AWS SES actions including GetSendQuota and UpdateAccountSendingEnabled, which can turn email sending on or off across an entire account in a region.
Read the original at Qualys Blog ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026