Threat reportCloud SecurityTL-2026-4181
Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
Password Spraying Campaign Targets AWS Root User Accounts (TL-2026-4181) is a medium-severity cloud security threat, first published 2026-10-22. It has no confirmed attribution, affects Amazon Web Services AWS root user console sign-in (accounts without, maps to 6 MITRE ATT&CK techniques (T1078.004, T1090, T1090.002), and is covered by 9 detection rules and 6 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4181
- Threat ID
- TL-2026-4181
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- CLOUD
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- multi-sector
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
How Password Spraying Campaign Targets AWS Root User Accounts works
Datadog Security Labs observed a password spraying campaign from July 24 to August 23, 2026 against AWS root user console accounts at more than 150 organizations, routed through proxy infrastructure. Organizations saw a median of two failed attempts (maximum eight); no successful authentication was observed and attacker intent is undetermined.
Datadog Security Labs reported a low-and-slow password spraying (brute force) campaign aimed at the AWS root user console sign-in of more than 150 organizations between 2026-07-24 and 2026-08-23. Targeted organizations typically recorded a median of two failed ConsoleLogin attempts, with a maximum of eight over the campaign window. The low per-target volume is consistent with spraying tradecraft designed to stay below lockout and alerting thresholds.
The traffic was tunneled through proxies. Source IPs span many countries and autonomous systems, and threat-intelligence sources flag all of them as hosting infrastructure, residential proxies, or similar. Two outdated browser user-agent strings were used: a Chrome/85.0.4183.83 + Edg/85.0.564.41 string and a Firefox/120.0 string, both claiming Windows NT 10.0. The report published no individual IP addresses.
Targeting shows no clear victimology; victims vary widely by country and industry. Because AWS root sign-in requires the account's root email address, the actor either possessed or derived root user email addresses (for example from leaks, phishing, or reconnaissance - the report does not state which). Datadog did not observe any successful authentication, so motive and follow-on activity are undetermined, and there is no attribution to a named actor.
Detection centers on AWS CloudTrail: ConsoleLogin events from signin.amazonaws.com where userIdentity.type is Root and responseElements.ConsoleLogin is Failure (errorMessage 'Failed authentication'), correlated with the two user agents and with the same source IP hitting multiple accounts. Recommended mitigations are root MFA (mandatory since June 2025; hardware MFA for management-account root), AWS Organizations service control policies restricting root, centralized root access with short-lived AssumeRoot sessions, and alerting on direct root sign-ins and credential changes.
MITRE ATT&CK techniques used in TL-2026-4181
Initial Access
Persistence
T1078.004 Valid Accounts: Cloud Accounts
Privilege Escalation
T1078.004 Valid Accounts: Cloud Accounts
Defense Evasion
T1078.004 Valid Accounts: Cloud Accounts
Command and Control
T1090 Proxy; T1090.002 External Proxy
Credential Access
T1110 Brute Force; T1110.003 Password Spraying
Reconnaissance
Affected products and versions in Password Spraying Campaign Targets AWS Root User Accounts
- Amazon Web Services — AWS root user console sign-in (accounts without root MFA are most exposed)
Vulnerable versions: Not a software vulnerability; root accounts relying on password-only authentication
Fixed in: Root user with MFA enabled
Remediation for Password Spraying Campaign Targets AWS Root User Accounts
Immediate actions
- Search CloudTrail for ConsoleLogin events with userIdentity.type=Root (Failure or Success) from 2026-07-24 onward, especially matching the two published user agents
- Confirm MFA is enabled on every root user, using hardware MFA for the management account
- Investigate any root ConsoleLogin Success preceded by failures, and any follow-on CreateUser, CreateAccessKey or DeleteTrail activity
- Rotate root passwords if any successful sign-in from an unrecognized source is found
Workarounds
- Apply AWS Organizations service control policies restricting root user actions in member accounts
- Reduce reliance on root credentials and minimize who knows the root email address
Longer-term hardening
- Use centralized root access management with short-lived AssumeRoot sessions instead of persistent root credentials
- Alert on direct root sign-ins and root credential changes
- Aggregate member-account CloudTrail in an Organizations trail so cross-account spraying from one IP is visible
Weaknesses (CWE) in Password Spraying Campaign Targets AWS Root User Accounts
Timeline of Password Spraying Campaign Targets AWS Root User Accounts
- AWS begins requiring MFA for root users of AWS Organizations management accounts (May 2024)
- AWS extends the root MFA requirement to standalone accounts and adds FIDO2 passkey support (June 2024)
- AWS introduces centralized root access management for Organizations, including short-lived AssumeRoot sessions (November 2024)
- AWS IAM enforces MFA for root users across all account types, including Organizations member accounts - the key control against this attack
- Password spraying against AWS root user console sign-in begins; failed ConsoleLogin attempts observed at 150+ organizations
- End of the observation window; median of two and maximum of eight failed attempts per organization, no successful authentication observed
- Datadog states nine built-in Cloud SIEM / Cloud Security Management rules cover the activity
- Datadog Security Labs publishes the report with the two user-agent IOCs and CloudTrail detection query
- SecurityOnline and other outlets republish the findings, describing residential proxies and spoofed Chrome/Firefox user agents
Sources cited for Password Spraying Campaign Targets AWS Root User Accounts
- Password spraying campaign targets AWS root user accounts across 150+ organizations (Datadog Security Labs)
- Datadog Security Labs - AWS root user bruteforce campaign (markdown version)
- Hackers Target AWS Root Accounts at 150+ Organizations in Password-Spraying Campaign (Cryptika)
- AWS password spraying campaign (SecurityOnline)
- Password spraying campaign targets AWS root user accounts across 150+ organizations (Hendry Adrian)
- Elastic Prebuilt Rule: AWS Root Console Login Password Spraying
- Elastic Security 8.19: AWS Root Console Login Password Spraying
- AWS IAM now enforces MFA for root users across all account types
- AWS locks down cloud security, hits 100% MFA enforcement for root users (The Register)
- Secure by Design: AWS enhances centralized security controls as MFA requirements expand (AWS Security Blog)
Detection coverage for TL-2026-4181
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4181 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.