✨ The Containment Era is here. →Explore ✨

aviatrix logoAviatrix

Overview

Threat intelligence hub

Command Center

Visualize blast radius & threats

Under Active Attack

Executive Summary

In early 2025, Amazon Threat Intelligence disclosed a sustained campaign by Russia's GRU-linked Sandworm (APT44) targeting Western critical infrastructure, with a focus on the energy sector. The threat actors shifted tactics from exploiting software vulnerabilities to exploiting misconfigured network edge devices hosted on AWS as their primary entry vector. Once inside, attackers intercepted sensitive network traffic to steal credentials and leveraged these to expand and maintain access across enterprise and critical infrastructure environments, including electric utilities, energy providers, and managed security providers. Remediation included notification of affected customers, removal of compromised AWS EC2 instances, and intelligence sharing with partners.

This incident marks a concerning evolution in nation-state attack tradecraft: adversaries are prioritizing misconfigurations over traditional exploits, highlighting the need for organizations to reassess cloud and hybrid network security. The prevalence of cloud-hosted infrastructure increases urgency around identity and segmentation defenses.

Why This Matters Now

Attackers are increasingly leveraging customer misconfiguration, rather than exploiting software vulnerabilities, as a low-cost and effective initial access method into cloud and hybrid environments. This shift underscores the urgent need for robust security hygiene and vigilant configuration management, especially as more organizations migrate mission-critical operations to the cloud.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers capitalized on customer misconfigurations of network edge devices hosted on AWS, bypassing traditional vulnerability exploitation to gain initial access.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Network segmentation, encrypted traffic controls, egress policy enforcement, and comprehensive east-west visibility would have contained and detected attacker movement early, disrupting critical stages of the kill chain. CNSF-aligned controls tailored for cloud workloads and edge devices directly mitigate risks from misconfiguration, credential intercept, lateral movement, and covert exfiltration.

Initial Compromise

Control: Zero Trust Segmentation

Mitigation: Unmanaged or misconfigured assets would be isolated and prevented from exposure.

Privilege Escalation

Control: Encrypted Traffic (HPE)

Mitigation: Credentials transmitted over the network remain protected from interception.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Internal movement between workloads and services is tightly controlled.

Command & Control

Control: Cloud Firewall (ACF) & Inline IPS (Suricata)

Mitigation: Malicious remote access and covert channels are detected and blocked in real-time.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound transfers to unapproved destinations are blocked or flagged.

Impact (Mitigations)

Anomalous behaviors are rapidly detected for swift response before operational impact.

Impact at a Glance

Affected Business Functions

  • Energy Production
  • Energy Distribution
  • Cloud Infrastructure Management
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $5,000,000

Data Exposure

Potential exposure of sensitive operational data, including system configurations and access credentials, leading to unauthorized access and control over critical infrastructure systems.

Recommended Actions

  • • Enforce zero trust segmentation to reduce attack surface and contain lateral movement from compromised edge devices.
  • • Mandate end-to-end encryption (IPsec/MACsec) for all sensitive internal and external network traffic to prevent credential interception.
  • • Apply strict egress controls and FQDN filtering to block unauthorized data transfers or outbound C2 communication.
  • • Deploy continuous east-west visibility, microsegmentation, and anomaly detection to quickly identify and stop lateral attacker movement.
  • • Regularly audit and govern configuration of all network edge and cloud-native assets, addressing misconfigurations before attackers can exploit them.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image