# Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations

> Datadog Security Labs observed a password spraying campaign from July 24 to August 23, 2026 against AWS root user console accounts at more than 150 organizations, routed through proxy infrastructure. Organizations saw a median of two failed attempts (maximum eight); no successful authentication was observed and attacker intent is undetermined.

- **Published:** 2026-10-22T20:18:29Z
- **Last reviewed:** 2026-10-22T20:18:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4181
- **ID:** TL-2026-4181
- **Severity:** MEDIUM
- **Category:** CLOUD
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Datadog Security Labs reported a low-and-slow password spraying (brute force) campaign aimed at the AWS root user console sign-in of more than 150 organizations between 2026-07-24 and 2026-08-23. Targeted organizations typically recorded a median of two failed ConsoleLogin attempts, with a maximum of eight over the campaign window. The low per-target volume is consistent with spraying tradecraft designed to stay below lockout and alerting thresholds.

The traffic was tunneled through proxies. Source IPs span many countries and autonomous systems, and threat-intelligence sources flag all of them as hosting infrastructure, residential proxies, or similar. Two outdated browser user-agent strings were used: a Chrome/85.0.4183.83 + Edg/85.0.564.41 string and a Firefox/120.0 string, both claiming Windows NT 10.0. The report published no individual IP addresses.

Targeting shows no clear victimology; victims vary widely by country and industry. Because AWS root sign-in requires the account's root email address, the actor either possessed or derived root user email addresses (for example from leaks, phishing, or reconnaissance - the report does not state which). Datadog did not observe any successful authentication, so motive and follow-on activity are undetermined, and there is no attribution to a named actor.

Detection centers on AWS CloudTrail: ConsoleLogin events from signin.amazonaws.com where userIdentity.type is Root and responseElements.ConsoleLogin is Failure (errorMessage 'Failed authentication'), correlated with the two user agents and with the same source IP hitting multiple accounts. Recommended mitigations are root MFA (mandatory since June 2025; hardware MFA for management-account root), AWS Organizations service control policies restricting root, centralized root access with short-lived AssumeRoot sessions, and alerting on direct root sign-ins and credential changes.

## MITRE ATT&CK

- T1110 Brute Force
- T1110.003 Password Spraying
- T1078.004 Cloud Accounts
- T1589.002 Email Addresses
- T1090 Proxy
- T1090.002 External Proxy
- T1078.004 Valid Accounts: Cloud Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1078.004 Valid Accounts: Cloud Accounts

## Sources

- [Password spraying campaign targets AWS root user accounts across 150+ organizations (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign/)
- [Datadog Security Labs - AWS root user bruteforce campaign (markdown version)](https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign.md)
- [Hackers Target AWS Root Accounts at 150+ Organizations in Password-Spraying Campaign (Cryptika)](https://www.cryptika.com/hackers-target-aws-root-accounts-at-150-organizations-in-password-spraying-campaign/)
- [AWS password spraying campaign (SecurityOnline)](https://securityonline.info/aws-password-spraying-campaign/)
- [Password spraying campaign targets AWS root user accounts across 150+ organizations (Hendry Adrian)](https://www.hendryadrian.com/?p=111738)
- [Elastic Prebuilt Rule: AWS Root Console Login Password Spraying](https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/credential_access_root_console_password_spraying)
- [Elastic Security 8.19: AWS Root Console Login Password Spraying](https://www.elastic.co/guide/en/security/8.19/aws-root-console-login-password-spraying.html)
- [AWS IAM now enforces MFA for root users across all account types](https://aws.amazon.com/about-aws/whats-new/2025/06/aws-iam-mfa-root-users-across-all-account-types)
- [AWS locks down cloud security, hits 100% MFA enforcement for root users (The Register)](https://www.theregister.com/2025/06/17/aws_enforces_mfa_root_users/)
- [Secure by Design: AWS enhances centralized security controls as MFA requirements expand (AWS Security Blog)](https://aws.amazon.com/blogs/security/secure-by-design-aws-enhances-centralized-security-controls-as-mfa-requirements-expand)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4181