Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
AI Summary
Attackers are actively validating stolen AWS credentials to identify those with access to Amazon Bedrock, a managed service for foundation models. Credential harvesting platforms like KMON_NOC and other tools test stolen keys by calling AWS STS GetCallerIdentity, then probe for Bedrock access using ListFoundationModels and Converse API calls. These tools also extract Bedrock-specific bearer tokens and assess financial value by checking promotional credits. Two Python scripts identified on VirusTotal perform similar validation and enumeration, indicating a growing trend in 'LLMjacking' where attackers monetize access to AI models. Defenders are advised to monitor for suspicious Bedrock API activity as early detection can prevent financial abuse.
AI-extracted · verify before operational use
Indicators of Compromise 66 extracted
| Type | Value | Detail |
|---|---|---|
| SHA-256 | c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc | Details → |
| SHA-256 | 923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608 | Details → |
| IP | 115[.]138[.]247[.]83 | Details → |
| IP | 116[.]106[.]179[.]94 | Details → |
| IP | 128[.]116[.]206[.]252 | Details → |
| IP | 138[.]94[.]168[.]132 | Details → |
| IP | 154[.]119[.]213[.]63 | Details → |
| IP | 157[.]100[.]141[.]65 | Details → |
| IP | 172[.]56[.]122[.]32 | Details → |
| IP | 173[.]92[.]116[.]211 | Details → |
| IP | 181[.]115[.]172[.]90 | Details → |
| IP | 181[.]51[.]32[.]38 | Details → |
| IP | 186[.]154[.]182[.]44 | Details → |
| IP | 190[.]56[.]117[.]218 | Details → |
| IP | 191[.]93[.]177[.]69 | Details → |
| IP | 196[.]177[.]214[.]142 | Details → |
| IP | 200[.]151[.]53[.]165 | Details → |
| IP | 206[.]206[.]119[.]201 | Details → |
| IP | 213[.]186[.]157[.]53 | Details → |
| IP | 45[.]11[.]61[.]22 | Details → |
| IP | 46[.]100[.]30[.]188 | Details → |
| IP | 47[.]230[.]250[.]253 | Details → |
| IP | 50[.]82[.]6[.]249 | Details → |
| IP | 51[.]15[.]192[.]215 | Details → |
| IP | 59[.]92[.]240[.]165 | Details → |
| IP | 71[.]76[.]4[.]45 | Details → |
| IP | 79[.]117[.]129[.]254 | Details → |
| IP | 82[.]86[.]130[.]180 | Details → |
| IP | 83[.]194[.]172[.]248 | Details → |
| IP | 84[.]50[.]134[.]231 | Details → |
| IP | 85[.]253[.]221[.]206 | Details → |
| IP | 88[.]167[.]240[.]60 | Details → |
| IP | 92[.]144[.]3[.]108 | Details → |
| IP | 92[.]216[.]157[.]153 | Details → |
| IP | 93[.]118[.]107[.]1 | Details → |
| IP | 98[.]44[.]224[.]55 | Details → |
| IP | 85[.]137[.]53[.]173 | Details → |
| IP | 87[.]58[.]197[.]199 | Details → |
| IP | 194[.]36[.]27[.]53 | Details → |
| IP | 216[.]126[.]227[.]187 | Details → |
| IP | 146[.]70[.]173[.]170 | Details → |
| IP | 173[.]249[.]254[.]173 | Details → |
| IP | 85[.]137[.]52[.]59 | Details → |
| IP | 103[.]148[.]197[.]54 | Details → |
| IP | 103[.]160[.]185[.]100 | Details → |
| IP | 108[.]168[.]65[.]226 | Details → |
| IP | 109[.]146[.]93[.]39 | Details → |
| IP | 112[.]78[.]151[.]90 | Details → |
| IP | 95[.]216[.]34[.]254 | Details → |
| IP | 89[.]249[.]72[.]22 | Details → |
| IP | 78[.]109[.]78[.]211 | Details → |
| IP | 192[.]74[.]128[.]184 | Details → |
| IP | 72[.]235[.]197[.]91 | Details → |
| IP | 137[.]103[.]56[.]107 | Details → |
| IP | 69[.]250[.]15[.]174 | Details → |
| IP | 138[.]199[.]15[.]176 | Details → |
| IP | 94[.]154[.]46[.]248 | Details → |
| IP | 94[.]154[.]46[.]249 | Details → |
| IP | 94[.]154[.]46[.]242 | Details → |
| IP | 94[.]154[.]46[.]243 | Details → |
| IP | 94[.]154[.]46[.]245 | Details → |
| IP | 94[.]154[.]46[.]246 | Details → |
| IP | 94[.]154[.]46[.]247 | Details → |
| IP | 94[.]154[.]46[.]250 | Details → |
| IP | 87[.]58[.]197[.]196 | Details → |
| IP | 151[.]243[.]18[.]111 | Details → |