AWS Credentials File Grab for 2026-10-04

Oct 04, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

United States of America: 4Germany: 2Belgium: 2United Kingdom of Great Britain and Northern Ireland: 1France: 1
United States of America440.0%
Germany220.0%
Belgium220.0%
United Kingdom of Great Britain and Northern Ireland110.0%
France110.0%

IP Address : ASN : City/Provider

  • 136.85.32.33 : ASNone : United States of America

  • 172.94.9.151 : AS3223 voxility llp : Frankfurt am Main

  • 185.177.72.31 : unknown : unknown

  • 185.177.72.56 : ASNone : Congleton

  • 188.165.63.131 : AS16276 ovh sas : France

  • 34.179.164.52 : AS15169 google llc : United States of America

  • 34.23.147.147 : ASNone : United States of America

  • 34.6.78.29 : ASNone : United States of America

  • 34.79.12.228 : AS396982 google : Brussels

  • 34.79.23.116 : AS396982 google : Brussels

  • 34.80.89.28 : unknown : unknown

  • 45.153.34.43 : AS44592 skylink data center bv : Germany

Share on: