JINX-2401 Tried to Hijack AWS Bedrock Models Using Compromised IAM Keys
Summary
Wiz Research traced JINX-2401 activity across AWS environments, where compromised IAM keys were used to create users and Bedrock policies. Service Control Policies blocked the observed model-access attempts; Wiz recommends restricting Bedrock access and monitoring Cloud
Key points
- Wiz Research identified the activity across multiple AWS environments and tracks the actor as JINX-2401.
- The actor used compromised IAM access keys for initial access and attempted to invoke Amazon Bedrock models.
- In a customer environment, the IAM user had Administrator Access and created additional IAM users, access keys, and a policy granting Bedrock permissions.
- The actor attempted to configure model access and invoke models, but Service Control Policies blocked the observed requests.
- Wiz reported a recurring IAM username pattern, the policy name “New_Policy,” and Bedrock permissions as indicators.
- Wiz recommends restricting Bedrock access with Service Control Policies, inventorying deployed AI models, and checking CloudTrail for suspicious IAM user and policy creation.
Article Details
- Attack Vectors
- JINX-2401 used compromised IAM user access keys to gain access to AWS accounts and attempt to invoke Amazon Bedrock models.
- With an account holding Administrator Access, the actor created additional IAM users, access keys, and a policy named New_Policy granting Bedrock model permissions.
- The actor created console profiles and attempted model-agreement requests before retrying model invocation with newly created credentials.
- Defensive Notes
- Use Service Control Policies to deny Bedrock access where it is not needed, or restrict access to specifically authorized members.
- Inventory deployed AI models and investigate irregularities.
- Monitor CloudTrail for CreateUser and CreatePolicy activity matching the reported IAM naming patterns, including the New_Policy name and usernames matching ^[A-Z][a-z]{5}[0-9]{3}$.
- Check for existing IAM users or policies matching these patterns and monitor repeated or unusual InvokeModel requests and model-access errors.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 146[.]70[.]230[.]149 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]165 | Proton VPN node IP observed as the source of JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]166 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]167 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]168 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]169 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]170 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]171 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]172 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]173 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]174 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]175 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]176 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]177 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]178 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]179 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]180 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]181 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]182 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]183 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]184 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
| IPV4 | 89[.]187[.]170[.]185 | Proton VPN node IP listed in connection with the reported JINX-2401 activity. |
MITRE ATT&CK
T1078.004 · Cloud AccountsThe actor used compromised IAM user access keys to access AWS accounts.T1098.001 · Additional Cloud CredentialsThe actor created IAM users, access keys, and a policy to establish additional account access.T1098.003 · Additional Cloud RolesThe actor created additional AWS access keys for newly created IAM users.T1098.004 · SSH Authorized KeysThe actor created a console profile for a newly created IAM user.T1098.005 · Device RegistrationThe actor attached a newly created policy granting Bedrock permissions to an IAM user.T1526 · Cloud Service DiscoveryThe actor attempted to invoke specific Bedrock foundation models.
Threat Actors
Vendors
Products
AI-SPMInventory AI models deployed in your environment and check for irregularities. Wiz customers can use AI-SPM to identify which models have been deployed. AWSResearch identified a threat actor we track as JINX-2401 attempting to hijack LLM models across multiple AWS environments. With the increasing use of LLMs, attempts to abuse these models as a way to monetizeWiz DefendWiz Defend has detection rules to identify unusual access to LLM models and specific known LLM attack techniques: