AWS Credentials File Grab for 2026-10-08

Oct 08, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

The Netherlands	8	27.6%
Canada	6	20.7%
Belgium	5	17.2%
United States	3	10.3%
Taiwan	2	6.9%
Lithuania	2	6.9%
France	1	3.4%
Japan	1	3.4%
India	1	3.4%

IP Address : ASN : City/Provider

107.167.181.44 : AS396982 Google LLC : Taipei
34.146.72.64 : AS396982 Google LLC : Tokyo
34.156.249.47 : AS396982 Google LLC : Brussels
34.158.152.37 : AS396982 Google LLC : Groningen
34.182.219.213 : AS396982 Google LLC : Washington
34.53.243.163 : AS396982 Google LLC : Brussels
34.77.137.207 : AS396982 Google LLC : Brussels
34.86.27.33 : AS396982 Google LLC : Washington
34.93.40.82 : AS396982 Google LLC : Mumbai
35.203.188.215 : AS396982 Google LLC : The Dalles
35.203.25.153 : AS396982 Google LLC : Montreal
35.203.57.62 : AS396982 Google LLC : Montreal
35.203.78.248 : AS396982 Google LLC : Montreal
35.203.83.240 : AS396982 Google LLC : Montreal
35.203.83.31 : AS396982 Google LLC : Montreal
35.203.95.196 : AS396982 Google LLC : Montreal
35.204.107.4 : AS396982 Google LLC : Groningen
35.204.126.29 : AS396982 Google LLC : Groningen
35.204.146.230 : AS396982 Google LLC : Groningen
35.204.188.113 : AS396982 Google LLC : Groningen
35.204.97.195 : AS396982 Google LLC : Groningen
35.205.116.134 : AS396982 Google LLC : Brussels
35.221.231.111 : AS396982 Google LLC : Taipei
35.241.132.20 : AS396982 Google LLC : Brussels
45.138.12.24 : unknown : Lithuania
45.138.12.28 : unknown : Lithuania
45.148.10.32 : AS48090 Techoff Srv Limited : Amsterdam
45.156.87.16 : AS197170 TechTies Inc. : Amsterdam

Share on: