Amazon Issues Attack Warning – Facts on Russian AWS Threat

Reports suggesting that Amazon recently issued a broad cyber attack warning targeting customers do not align with official documentation from AWS. While the company maintains robust DDoS protection capabilities and regularly updates security guidance, no singular 2024 attack warning matching that description appears in official AWS security channels.

What does exist is a December 2025 threat intelligence report detailing Russian state-sponsored targeting of Western critical infrastructure, including misconfigured customer edge devices hosted on AWS. This article examines what Amazon and AWS have actually communicated regarding security threats, what protections exist, and what customers should understand about the current threat landscape.

What Attack Is Amazon Warning About?

Investigating official AWS security channels reveals no 2024-wide cyber attack warning matching the broad description circulating in search results. The AWS Security Bulletins page lists investigated issues, but none correspond to a generalized attack alert for that period.

Instead, AWS documentation emphasizes ongoing automatic mitigations and proactive security tools rather than event-specific warnings. For network and transport layer attacks, AWS Shield automatically deploys protections including VPC network ACLs at the network border for Shield Advanced subscribers during larger events.

Application layer threats operate differently. AWS detects and notifies Shield Advanced customers via CloudWatch alarms but does not auto-mitigate to avoid blocking legitimate traffic. Customers can respond manually or enable proactive engagement, where the AWS Shield Response Team triages events, creates AWS WAF rules, and applies them with customer consent.

The Nature of Potential Threats

AWS documentation identifies several attack vectors that customers should monitor. HTTP/2 traffic spikes have reached 155 million requests per second in prior years, with AWS capable of detecting such volumes. Layer 7 mitigations include techniques like HTTP/2 rapid reset attacks.

AWS Shield Advanced absorbs volumetric and request-based attacks at both IP and Layer 7 levels, typically within 5 to 10 seconds. In multi-vector scenarios, AWS prioritizes fixing DNS impacts first before addressing other attack vectors.

Key Protection Tools Available

• Amazon CloudFront and AWS WAF for attack identification and Layer 7 mitigation
• AWS Shield Advanced for volumetric attack absorption
• CloudWatch alarms for threat detection and notification
• AWS Shield Response Team for proactive engagement and rule creation

Attack Details at a Glance

Why Did Amazon Issue This Attack Warning?

The December 2025 AWS Security Blog post provides the clearest official communication regarding threat actor activity. The post details how Russian state-sponsored groups, specifically linked to GRU and Sandworm operations, have targeted Western critical infrastructure.

The targeting focuses specifically on misconfigured customer network edge devices hosted on AWS, such as EC2 instances running network appliances. This is not an attack on AWS infrastructure itself but exploitation of customer configuration errors.

When Was This Communication Issued?

The official threat intelligence report was published in December 2025. The underlying campaign activity spans multiple years, with the earliest documented exploitation occurring during 2021 to 2022.

Who Are the Targets?

The campaign targets organizations operating critical infrastructure in Western nations. Specifically, the threat actors search for customer edge devices with configuration weaknesses, exposed interfaces, or running outdated software.

AWS customers running network appliances on EC2 instances without proper hardening represent the primary attack surface. This means the vulnerability lies in customer deployment practices, not in AWS’s underlying infrastructure.

Potential Impact on Affected Organizations

Organizations whose devices were compromised face risks including credential harvesting and replay attacks. Threat actors have deployed packet capture tools to intercept authentication data, enabling lateral movement within customer environments.

The shift toward sustained misconfiguration targeting and credential-based attacks, rather than zero-day exploits, suggests the actors are adapting to improved security postures that limit exposure to novel vulnerabilities.

Is Amazon Currently Under Attack?

No evidence indicates that AWS infrastructure itself is under active cyber attack. The December 2025 report describes targeting of customer misconfigurations, not AWS platform vulnerabilities. Amazon’s own services remain operational and secure.

Separately, a major AWS US-EAST-1 outage occurred in October 2025, impacting applications including Alexa, Snapchat, and Fortnite. This incident, documented by Enfortra and TechRadar’s live coverage, was not cyber-related but rather an infrastructure availability issue.

How Serious Is the Current Threat Level?

The Russian state-sponsored campaign represents a serious threat for organizations running vulnerable network edge devices on AWS. However, the attack surface is limited to misconfigurations and poor security practices rather than inherent AWS weaknesses.

The campaign’s reliance on configuration errors and credential theft over zero-day exploits indicates that organizations maintaining proper security hygiene face significantly reduced risk.

What Information Remains Unclear

While AWS has documented the campaign timeline and techniques, certain details remain uncertain. The full scope of compromised organizations is not publicly disclosed. Additionally, the complete list of indicators of compromise beyond the mentioned proxy IP has not been fully released.

Attribution to specific GRU units or Sandworm subgroups is stated in the AWS report but may not represent the complete picture of involved threat actors. Further intelligence from government agencies may supplement public reporting.

What Should Customers Do Following Amazon’s Warning?

AWS has published specific customer protection steps as 2026 security priorities. These recommendations address the misconfiguration-based attack vector directly and provide actionable guidance for organizations operating network edge devices on AWS.

Immediate Actions Recommended

• Audit all edge devices for packet capture installations and exposed management interfaces
• Segment networks to limit lateral movement potential
• Enforce multi-factor authentication on all administrative access
• Remove default credentials and configurations on network appliances
• Review authentication logs for signs of credential replay attacks

Security Tool Implementation

AWS recommends deploying specific tools for vulnerability management and threat detection. Amazon Inspector enables vulnerability scanning across EC2 instances, helping identify outdated software and configuration weaknesses that could be exploited.

GuardDuty and CloudTrail provide continuous monitoring for suspicious activity, with GuardDuty offering threat detection capabilities and CloudTrail maintaining audit logs for forensic analysis. Together, these services help organizations detect the credential harvesting and replay techniques described in the threat intelligence report.

Architectural Considerations

Beyond immediate hardening, AWS guidance emphasizes architectural preparation. Organizations should arch their environments with DDoS resilience in mind, implementing high request rate monitoring on APIs and load balancers.

Security teams should train on response procedures before incidents occur. Having documented runbooks and practiced responses ensures faster containment when threats are detected.

Timeline of Russian State-Sponsored Targeting Campaign

The campaign documented by AWS threat intelligence spans several years, with techniques and focus areas evolving over time.

1. 2021-2022: Initial targeting through WatchGuard exploits and identification of customer configuration errors
2. 2022-2023: Continued exploitation of Confluence vulnerabilities alongside persistent misconfiguration issues
3. 2024: Veeam exploits leveraged alongside ongoing misconfiguration targeting; proxy IP 212.47.226.64 identified as indicator of compromise
4. 2025: Strategic shift toward sustained misconfiguration targeting, credential harvesting, and packet capture deployment for replay attacks
5. December 2025: AWS publishes public threat intelligence report detailing campaign

Confirmed Information Versus Remaining Uncertainties

Understanding the Broader Context

This campaign reflects a broader trend in advanced persistent threat operations shifting from infrastructure exploitation toward configuration weakness targeting. As organizations improve patch management and vulnerability response, threat actors adapt by focusing on deployment errors that remain prevalent even when underlying software is current.

AWS occupies a unique position in the threat landscape as a cloud provider serving millions of organizations globally. While AWS infrastructure itself remains secure, the sheer scale of customer deployments creates inevitable exposure to configuration errors that sophisticated actors can discover and exploit.

The campaign’s focus on network edge devices indicates the actors seek high-value targets with persistent network access, suitable for long-term intelligence gathering or potential disruptive operations against critical infrastructure sectors. Understanding the broader context helps organizations recognize why certain infrastructure components become priority targets for state-sponsored operations.

This activity reflects the evolving tradecraft of state-sponsored threat actors, who increasingly prioritize reliable configuration exploits over uncertain zero-day vulnerabilities.

— AWS Security Blog, December 2025

What the Sources Say

Multiple authoritative sources inform the current understanding of AWS security posture and the documented threat campaign.

AWS official documentation describes DDoS mitigation capabilities and customer response options. The AWS WAF developer guide outlines both automated protections and manual response pathways available to customers.

AWS threat intelligence published in December 2025 provides the most comprehensive account of the Russian state-sponsored campaign. The AWS security talks complement this with technical details on detection capabilities and response procedures.

AWS automatically mitigates network and transport layer DDoS attacks using services like AWS Shield, deploying protections such as VPC network ACLs at the network border for Shield Advanced subscribers.

— AWS DDoS Response Documentation

Summary and Recommendations

The search for an Amazon attack warning reveals a more nuanced situation than a singular crisis event. AWS has not issued a broad 2024 cyber attack warning matching common descriptions. Instead, the company maintains documented DDoS protection capabilities and published detailed threat intelligence on Russian state-sponsored targeting of misconfigured customer edge devices in December 2025.

Organizations using AWS should focus on the specific protection steps outlined by AWS: audit edge devices, enforce MFA, segment networks, and deploy Inspector, GuardDuty, and CloudTrail for detection. Understanding threat context helps prioritize security investments appropriately.

The absence of a specific 2024 warning does not indicate reduced threat levels. Rather, AWS security communication emphasizes ongoing protection capabilities and customer hardening rather than reactive event-based alerts. Organizations should ensure their security teams understand available tools and maintain readiness to respond when AWS publishes new threat intelligence.

Frequently Asked Questions