Amazon Web Services (AWS) has attributed a persistent multi-year cyber espionage campaign targeting Western critical infrastructure, particularly the energy sector, to a group strongly linked with Russia’s Main Intelligence Directorate (GRU), known widely as Sandworm (or APT44).
In a report released Monday, the cloud giant’s threat intelligence teams revealed that the Russian-nexus actor has maintained a “sustained focus” on North American and European critical infrastructure, with operations spanning from 2021 through the present day.
Misconfigured Devices are the Attackers’ Gateway
Crucially, the AWS investigation found that the initial successful compromises were not due to any weakness in the AWS platform itself, but rather the exploitation of customer misconfigured devices. The threat actor is exploiting a fundamental failure in network defense, that of, customers failing to properly secure their network edge devices and virtual appliances.
The operation focuses on stealing credentials and establishing long-term persistence, often by compromising third-party network appliance software running on platforms like Amazon Elastic Compute Cloud (EC2).
AWS CISO CJ Moses commented in the report, warning, “Going into 2026, organizations must prioritize securing their network edge devices and monitoring for credential replay attacks to defend against this persistent threat.”
Persistence and Credential Theft, Part of the Sandworm Playbook
AWS observed the GRU-linked group employing several key tactics, techniques, and procedures (TTPs) aligned with their historical playbook:
-
Exploiting Misconfigurations: Leveraging customer-side mistakes, particularly in exposed network appliances, to gain initial access.
-
Establishing Persistence: Analyzing network connections to show the actor-controlled IP addresses establishing persistent, long-term connections to the compromised EC2 instances.
-
Credential Harvesting: The ultimate objective is credential theft, enabling the attackers to move laterally across networks and escalate privileges, often targeting the accounts of critical infrastructure operators.
AWS’s analysis of infrastructure overlaps with known Sandworm operations—a group infamous for disruptive attacks like the 2015 and 2016 power grid blackouts in Ukraine—provides high confidence in the attribution.
Recently, threat intelligence company Cyble had detected advanced backdoors targeting the defense systems and the TTPs closely resembled Russia’s Sandworm playbook.
Read: Cyble Detects Advanced Backdoor Targeting Defense Systems via Belarus Military Lure
Singular Focus on the Energy Supply Chain
The targeting profile analyzed by AWS’ threat intelligence teams demonstrates a calculated and sustained focus on the global energy sector supply chain, including both direct operators and the technology providers that support them:
-
Energy Sector: Electric utility organizations, energy providers, and managed security service providers (MSSPs) specializing in energy clients.
-
Technology/Cloud Services: Collaboration platforms and source code repositories essential for critical infrastructure development.
-
Telecommunications: Telecom providers across multiple regions.
The geographic scope of the targeting is global, encompassing North America, Western and Eastern Europe, and the Middle East, illustrating a strategic objective to gain footholds in the operational technology (OT) and enterprise networks that govern power distribution and energy flow across NATO countries and allies.
From Cloud Edge to Credential Theft
AWS’ telemetry exposed a methodical, five-step campaign flow that leverages customer misconfiguration on cloud-hosted devices to gain initial access:
-
Compromise Customer Network Edge Device hosted on AWS: The attack begins by exploiting customer-side vulnerabilities or misconfigurations in network edge devices (like firewalls or virtual appliances) running on platforms like Amazon EC2.
-
Leverage Native Packet Capture Capability: Once inside, the actor exploits the device’s own native functionality to eavesdrop on network traffic.
-
Harvest Credentials from Intercepted Traffic: The crucial step involves stealing usernames and passwords from the intercepted traffic as they pass through the compromised device.
-
Replay Credentials Against Victim Organizations’ Online Services and Infrastructure: The harvested credentials are then “replayed” (used) to access other services, allowing the attackers to pivot from the compromised appliance into the broader victim network.
-
Establish Persistent Access for Lateral Movement: Finally, the actors establish a covert, long-term presence to facilitate lateral movement and further espionage.
Secure the Edge and Stop Credential Replay
AWS has stated that while its infrastructure remains secure, the onus is on customers to correct the foundational security flaws that enable this campaign. The report strongly advises organizations to take immediate action on two fronts:
-
Secure Network Edge: Conduct thorough audits and patching of all network appliances and virtual devices exposed to the public internet, ensuring they are configured securely.
-
Monitor for Credential Replay: Implement advanced monitoring for indicators of compromise (IOCs) associated with credential replay and theft attacks, which the threat actors are leveraging to move deeper into target environments.
