Wiz Uses Behavioral Cloud IOCs to Track Credential-Abusing Actors
Summary
Wiz describes using honeypot data and cloud API patterns to identify credential abuse and link incidents to an actor it calls “Bapak.” In observed cases, the actor lacked permission to create the attempted ECS cluster.
Key points
- Wiz says it observed “Bapak” across multiple customers and believes the activity may involve one actor or related actors scanning for exposed cloud credentials.
- In observed cases, the activity included importing an SSH key, querying account and environment details, and attempting to create an ECS cluster named bapak1; the attempts failed for lack of permission.
- Wiz linked incidents using a repeated SSH public key and identified the cluster name and key material as potential behavioral indicators.
- Its method uses intentionally exposed cloud credentials in a honeypot, then correlates API calls and caller IP metadata with activity in real cloud environments.
- Wiz recommends searching a narrow time window—around seven days in its example—to reduce false matches from IP addresses changing hands, then pivoting from compromised identities to related activity.
- The article recommends monitoring cloud logs and runtime telemetry, integrating behavior-based detections into security platforms, and maintaining normal-activity baselines.
Article Details
- Attack Vectors
- Abuse of exposed or stolen cloud credentials to access victim cloud environments.
- After access, the observed Bapak activity imported an SSH key, queried caller identity, permissions, subnets, and instances, then attempted to create an ECS cluster named bapak1.
- The article describes public credential leaks and infostealer operators selling credentials as possible sources of compromised cloud keys; it does not establish how Bapak obtained its keys.
- Defensive Notes
- Monitor cloud activity logs such as CloudTrail for suspicious sequences of API calls and unusual request parameters, including cluster names and imported public-key material.
- Use honeypots to identify malicious caller IP addresses and API-call patterns, then pivot into real environments within a narrow time window; the article suggests around seven days to reduce false positives from IP reassignment.
- Correlate activity by credentials, caller IP metadata, and repeated API parameters; maintain baselines for expected behavior and investigate unusual locations, VPN use, privilege changes, and unexpected cloud-resource activity.
- Integrate behavioral detections into a SIEM or cloud-native security platform and incorporate alerts into incident response.
MITRE ATT&CK
T1069.003 · Cloud GroupsBapak examined permissions associated with the leaked key, including through ListAttachedUserPolicies.T1078.004 · Cloud AccountsBapak used compromised cloud keys to access victim environments; the article does not establish how the keys were obtained.T1098.004 · SSH Authorized KeysAfter gaining access, Bapak called ImportKeyPair to add an SSH public key intended to enable access to machines it would create.T1526 · Cloud Service DiscoveryBapak queried cloud-service information using calls including GetCallerIdentity and ListAttachedUserPolicies.T1580 · Cloud Infrastructure DiscoveryBapak called DescribeSubnets and DescribeInstances to gather information about the victim's cloud infrastructure.
Threat Actors
Vendors
Amazon Web ServicesA public leak, for example accidentally publishing an AWS key to a public git repo. Wiza 71% increase of incidents year-over-year, this trend doesn’t seem to be slowing down. That is why at Wiz we are always looking for novel methods to identify theft and abuse of compromised credentials.
Products
CloudTrailBehavioral Indicators can be used to describe any of the following activities, as reflected in various logs such as CloudTrail: ECSThese actions are followed by a call to the ECS API CreateCluster attempting to create a cluster with the name bapak1. Fortunately, in the incidents we observed the attacker lacked the permissions required to actuallyWiz DefendWiz Defend has built-in detection rules incorporating both atomic and behavioral cloud IOCs, sourced from public threat reporting, private threat intelligence sharing, and threat intel collected by Wiz Research in the
Tools
PacuNote that attackers can use tools like Quiet Riot or Pacu to automate the identification of IAM roles and users without alerting the target, as these activities are logged only in the attacker’s environment.Quiet RiotNote that attackers can use tools like Quiet Riot or Pacu to automate the identification of IAM roles and users without alerting the target, as these activities are logged only in the attacker’s environment.