56 AWS API calls in 141 milliseconds: Inside an AI-run intrusion

Reported by Elastic Security Labs (Samir Bousseaden,Bryan Porras Blanch,Terrance DeJesus)

Summary by Cyber Security News13 Nov 2026, 15:30 CET

About this summary. This is a short excerpt from the description that Elastic Security Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.elastic.co/security-labs/threat-command/cyberstrikeai-aws-cloudtrail-intrusion

One server read 56 EC2 user data scripts in 141 milliseconds. Then it went quiet for 14 days and came back. That gap did more damage than the burst, because fixed correlation windows cannot span two weeks.

Read the full article at Elastic Security Labs →

Source attribution: headline and facts are from Elastic Security Labs (elastic.co). Summary method: excerpt of the source description. See our source attribution policy.