AWS Credentials File Grab for 2026-09-26

Sep 26, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

United States	6	21.4%
Belgium	6	21.4%
Singapore	3	10.7%
Germany	3	10.7%
Lithuania	3	10.7%
The Netherlands	2	7.1%
France	1	3.6%
Bulgaria	1	3.6%
Japan	1	3.6%
Canada	1	3.6%
Romania	1	3.6%

IP Address : ASN : City/Provider

134.185.93.91 : AS31898 Oracle Corporation : Loyang
144.172.93.238 : AS14956 RouterHosting LLC : Ogden
161.118.246.79 : AS31898 Oracle Corporation : Loyang
178.18.240.38 : AS51167 Contabo GmbH : Lauterbourg
185.218.86.5 : unknown : Bulgaria
207.175.220.59 : AS396982 Google LLC : Brussels
34.153.215.84 : AS396982 Google LLC : Tokyo
34.156.135.225 : AS396982 Google LLC : Brussels
34.156.22.151 : AS396982 Google LLC : Brussels
34.159.199.49 : AS396982 Google LLC : Frankfurt am Main
34.159.202.132 : AS396982 Google LLC : Frankfurt am Main
34.159.229.182 : AS396982 Google LLC : Frankfurt am Main
34.16.104.26 : AS396982 Google LLC : Council Bluffs
34.170.215.77 : AS396982 Google LLC : Council Bluffs
34.177.84.228 : AS396982 Google LLC : Singapore
34.178.234.70 : AS396982 Google LLC : Groningen
34.178.239.21 : AS396982 Google LLC : Groningen
34.186.207.93 : AS396982 Google LLC : Montreal
34.52.229.253 : AS396982 Google LLC : Brussels
34.62.82.165 : AS396982 Google LLC : Brussels
34.77.137.207 : AS396982 Google LLC : Brussels
35.190.139.144 : AS396982 Google LLC : North Charleston
45.138.12.24 : unknown : Lithuania
45.138.12.25 : unknown : Lithuania
45.138.12.52 : unknown : Lithuania
8.229.153.87 : AS396982 Google LLC : The Dalles
80.94.95.211 : AS204428 SS-Net : Romania

Share on: