Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations — Threadlinqs Intelligence
As of 2026-08-31, Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations is a medium-severity cloud threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 7 indicators of compromise.
Threat ID: TL-2026-2263 · Severity: MEDIUM · Status: ACTIVE · Category: CLOUD
Datadog Security Labs identified a password-spraying campaign that made repeated failed ConsoleLogin attempts against AWS account root-user credentials at 150+ organizations between July 24 and August
Between July 24 and August 23, 2026, Datadog Security Labs observed a password-spraying campaign against the AWS account root-user console sign-in flow at more than 150 organizations. The campaign exploited a structural quirk of AWS's authentication API: generating a failed `ConsoleLogin` event (CloudTrail event name `ConsoleLogin`, provider `signin.amazonaws.com`, event type `AwsConsoleSignIn`) for the root user requires the caller to already know the account's registered root-user email address. Attackers either worked from a pre-compiled list of root-user emails or ran enumeration attacks to validate which addresses corresponded to real root accounts, then repeatedly submitted authentication attempts against each. Attempt volume per organization was low and slow — a median of two attempts, with some organizations seeing up to eight — consistent with a password-spraying (low-and-slow, many-targets) pattern rather than a high-volume brute-force against a single account.
Requests were routed through third-party proxy infrastructure; source IPs were flagged by threat intelligence as hosting infrastructure, residential proxies, or similar, and spanned a wide range of countries and ASNs with no single dominant origin. Only two distinct browser user-agent strings were logged across the failed attempts (a Chrome/Edge-on-Windows string and a Firefox-on-Windows string), suggesting a constrained, possibly scripted or shared tooling set behind the requests despite the distributed source infrastructure.
No successful root-user authentication was observed at any of the 150+ affected organizations across the full campaign window, and Datadog found no clear victimology: targets varied widely by country and industry with no discernible sector or geographic concentration. Datadog explicitly states it cannot conclusively determine the actor's motive, and no attribution to a known threat actor, group, or toolset is offered.
Datadog's own detection guidance for this exact activity is a Cloud SIEM query — `source:cloudtrail @userIdentity.type:Root @eventName:ConsoleLogin @responseElements.ConsoleLogin:(Failure OR Success)` — layered across two existing default detection rules: 'AWS root account activity' (tiers Critical for TI-flagged malicious IPs, High for a successful root console login, Medium for sensitive-service writes or suspicious-IP activity, Low for ≥5 failed logins within 5 minutes; mapped to TA0001/T1078) and 'Potential brute force attack on AWS ConsoleLogin' (group-by correlation of failed `ConsoleLogin` attempts, mapped to TA0006/T1110, last revised 2023-07-10). Elastic Security ships an equivalent prebuilt rule, 'AWS Management Console Brute Force of Root User Identity' (KQL: `data_stream.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and aws.cloudtrail.user_identity.type:Root and event.outcome:failure`; High severity, risk score 73, 6-minute threshold window, capped at 100 alerts per execution, mapped to TA0006/T1110/T1110.001), which independently corroborates that root-ConsoleLogin brute-forcing is a recognized, pre-existing detection use case this campaign fell squarely into.
The campaign lands against a backdrop of AWS's multi-year push to lock down root-user authentication: staged MFA enforcement for root users (standalone accounts from mid-2024, AWS Organizations management accounts from May 2024, and member accounts from June 2025 with a 35-day registration grace period) and the November 2024 launch of Centralized Root Access Management (STS `AssumeRoot`), which lets organizations strip long-term root credentials entirely and broker short-lived, task-scoped root sessions (e.g. `IAMCreateRootUserPassword`, `IAMDeleteRootUserCredentials`, `IAMAuditRootUserCredentials`, `S3UnlockBucketPolicy`, `SQSUnlockQueuePolicy`) instead. Because root retains unrestricted, unrestrictable access to every AWS service in the account — including billing, GovCloud sign-up, KMS key recovery, an
Timeline
- Datadog updates the group-by fields on its 'Potential brute force attack on AWS ConsoleLogin' default detection rule, the same rule class later used to detect this 2026 campaign's failed root-login pattern.
- AWS publicly announces plans to require MFA for AWS account root users, the first step in a multi-year root-security hardening effort.
- AWS begins enforcing MFA for root users of AWS Organizations management accounts, starting with larger environments.
- MFA enforcement extends to root users of standalone AWS accounts not managed via AWS Organizations.
- AWS launches Centralized Root Access Management (STS AssumeRoot), allowing organizations to remove long-term root credentials and broker short-lived, task-policy-scoped root sessions instead of direct root sign-in.
- AWS extends root-user MFA enforcement to member accounts within AWS Organizations, with a 35-day grace period for MFA registration after first console sign-in.
- Earliest failed root-user ConsoleLogin attempts attributed to the campaign begin appearing in Datadog customer CloudTrail telemetry.
- Last observed failed root-user ConsoleLogin attempt tied to the campaign; no successful authentication was recorded across the entire window at any of the 150+ affected organizations.
- Datadog Security Labs publishes 'Password spraying campaign targets AWS root user accounts across 150+ organizations,' disclosing the campaign, its telemetry, and detection/mitigation guidance.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 7 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
CLOUD, MEDIUM, threat intelligence, cybersecurity, T1589.002, T1583.005, T1583.003, T1588.002, T1110, T1110.003, T1110.001, T1090.002, T1665, T1078.004
