AWS Credentials File Grab for 2026-09-24

Sep 24, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

United States	7	26.9%
Belgium	5	19.2%
The Netherlands	4	15.4%
Singapore	3	11.5%
Japan	1	3.8%
Germany	1	3.8%
Canada	1	3.8%
Taiwan	1	3.8%
India	1	3.8%
Romania	1	3.8%
Ireland	1	3.8%

IP Address : ASN : City/Provider

104.28.222.43 : AS13335 Cloudflare, Inc. : Singapore
104.28.222.46 : AS13335 Cloudflare, Inc. : Singapore
144.172.99.12 : AS14956 RouterHosting LLC : Staten Island
207.175.220.59 : AS396982 Google LLC : Brussels
209.112.91.75 : AS23470 ReliableSite.Net LLC : United States
34.136.179.43 : AS396982 Google LLC : Council Bluffs
34.153.215.84 : AS396982 Google LLC : Tokyo
34.156.135.225 : AS396982 Google LLC : Brussels
34.159.202.132 : AS396982 Google LLC : Frankfurt am Main
34.16.104.26 : AS396982 Google LLC : Council Bluffs
34.169.11.105 : AS396982 Google LLC : The Dalles
34.169.34.210 : AS396982 Google LLC : The Dalles
34.169.36.129 : AS396982 Google LLC : The Dalles
34.177.84.228 : AS396982 Google LLC : Singapore
34.178.234.70 : AS396982 Google LLC : Groningen
34.178.239.21 : AS396982 Google LLC : Groningen
34.186.207.93 : AS396982 Google LLC : Montreal
34.52.133.111 : AS396982 Google LLC : Brussels
34.90.51.94 : AS396982 Google LLC : Groningen
35.189.191.94 : AS396982 Google LLC : Taipei
35.205.254.119 : AS396982 Google LLC : Brussels
35.241.202.92 : AS396982 Google LLC : Brussels
35.244.17.239 : AS396982 Google LLC : Mumbai
45.148.10.120 : AS48090 Techoff Srv Limited : Amsterdam
80.94.95.211 : AS204428 SS-Net : Romania
87.192.41.15 : unknown : Ireland

Share on: