In a recent cybersecurity incident, over 150 organizations faced a password-spraying campaign aimed at their AWS root accounts. This attack, identified by Datadog Security Research, took place from July 24 to August 23, 2026, and involved repeated failed login attempts on highly privileged accounts.
Understanding AWS Root Accounts
The AWS root account is a critical component of cloud infrastructure, providing unrestricted access to resources, billing, and administrative functions. Unauthorized access to such accounts could grant attackers significant control over an organization’s cloud environment.
Datadog’s findings reveal that most affected organizations experienced minimal login attempts, with a median of two failed attempts. However, some entities reported up to eight attempts during the attack period. Importantly, researchers found no evidence of successful account compromises.
Attack Techniques and Defense Strategies
Password spraying is the technique used in this campaign, where attackers try a limited set of common passwords across many accounts. This method is designed to bypass traditional account lockout mechanisms that are triggered during brute-force attacks.
Two distinct browser user-agent strings were linked to the attack. One mimicked an older Microsoft Edge browser, while the other imitated Firefox. These identifiers, although easily spoofed, can assist defenders in identifying related log activities.
The attackers also utilized proxy infrastructure, distributing source IP addresses across numerous countries, complicating geographical blocking measures. This infrastructure is often associated with hosting services or residential proxies to conceal the origin of malicious activities.
Broader Implications and Security Recommendations
The attack did not target any specific industry or country, indicating the use of a broad list of potential AWS account email addresses. This suggests that the attackers might have acquired emails through data leaks or phishing and tested numerous corporate emails to identify valid AWS root identities.
AWS root accounts remain attractive targets due to their extensive capabilities. Despite AWS enforcing multi-factor authentication (MFA) for root accounts since June 2025, organizations are advised not to rely solely on MFA. Security teams should actively monitor AWS CloudTrail logs for root-level activities and implement stringent policies to restrict unnecessary root account usage.
Organizations should also enforce service control policies, limit root access, and protect root credentials with robust, phishing-resistant MFA solutions. These proactive measures can significantly enhance the security of cloud environments against such sophisticated cyber threats.
