North Korea-Linked Hackers Target Crypto Supply Chain in Coordinated Campaign A sophisticated cyberattack campaign, attributed to North Korea-linked threat actors, has targeted multiple layers of the cryptocurrency supply chain, compromising staking platforms, exchange software providers, and exchanges themselves. The operation, uncovered in January 2026, resulted in the theft of proprietary source code, private keys, and cloud-stored secrets, marking one of the most calculated intrusions in the crypto sector in recent months. The attackers employed two distinct intrusion methods: exploiting CVE-2025-55182, a vulnerability in the React2Shell framework, to breach crypto staking platforms, and leveraging stolen AWS access tokens to bypass initial exploitation and directly infiltrate cloud infrastructure. Researchers at Ctrl-Alt-Intel gained rare insight into the attackers’ operations after discovering exposed open directories containing shell history logs, archived source code, and tool configurations, revealing the full scope of the campaign. Among the stolen assets were .env files containing hardcoded private keys for Tron blockchain wallets, with blockchain records showing 52.6 TRX transferred during the exploitation window though it remains unclear whether the North Korea-linked actors or another threat group executed the transfer. Additionally, compromised Docker container images from a cryptocurrency exchange contained hardcoded database credentials, internal configurations, and proprietary exchange logic, aligning with North Korea’s documented strategy of pre-positioning for large-scale crypto theft. In the AWS-focused phase, the attackers conducted broad enumeration of EC2 instances, RDS databases, S3 buckets, Lambda functions, and EKS clusters, using grep searches to extract sensitive files like .pem, .key, and .ppk credentials. They also downloaded Terraform state files, which often store infrastructure secrets, and pivoted into Kubernetes clusters by updating kubeconfig files. Once inside, they exfiltrated ConfigMaps, Kubernetes Secrets, and Docker container images in plaintext. For command-and-control, the threat actors deployed VShell on port 8082 and used FRP as a tunneling proxy over port 53 (DNS), evading standard network monitoring. Connections to their primary VPS were routed over IPv6, further bypassing detection tools designed for IPv4 traffic. The campaign underscores the attackers’ meticulous planning and deep access to critical crypto infrastructure.

AI-Powered AWS Intrusion Demonstrates Rapid Cloud Compromise in 72 Hours A recent large-scale AWS intrusion highlights how AI-assisted attackers can escalate from initial access to full environmental compromise in just 72 hours without relying on novel exploits. Instead, threat actors leveraged unprecedented speed, scale, and orchestration to chain familiar cloud techniques, exploiting pre-existing weaknesses in visibility, permissions, and credential management. The attack began when the financially motivated threat actor gained an AWS access key by exploiting a vulnerability in an internet-facing application. From there, they pivoted across cloud infrastructure, source-control repositories, CI/CD pipelines, and runtime services, harvesting credentials to trigger overlapping "attack waves" of discovery, persistence, and impact-oriented actions. Rather than deploying ransomware, the actor sought control over critical cloud services to threaten disruption as extortion leverage. Forensic evidence suggests AI-driven tooling played a key role. In one instance, four access keys tied to different accounts were used from the same IP and user-agent within a single second a level of concurrency nearly impossible for manual operators. The attacker also executed hundreds of unique SQL queries across databases, rapidly mapping cloud relationships with environment-specific adaptations. Some artifacts were even framed as a "pentest" or "red team" exercise, potentially to mislead investigators or bypass AI tool restrictions. This incident aligns with broader 2026 trends, where AI has compressed cloud attack timelines. In a separate November 2025 case, a threat actor used large language models to escalate from initial access to full AWS administrative control in just eight minutes without zero-days or malware by automating reconnaissance, privilege escalation, and lateral movement across 19 AWS identities. Researchers note AI "removes friction," enabling attackers to enumerate services and evaluate privilege paths faster than manual operators. The attack’s success stemmed from long-standing security gaps: exposed secrets in S3 buckets and CI/CD environments, overly permissive cloud permissions, and a lack of predefined containment playbooks. A 2026 Sygnia CISO survey found 73% of security leaders believe their organizations are unprepared for such rapid, AI-driven intrusions. Defensive shifts are emerging, including momentum-based incident response that runs investigation and containment in parallel. Key recommendations include aggressive credential rotation, identity-first security (MFA, session revocation), broad network containment, and automated detection workflows to match attacker speed. Rebuilding compromised environments from trusted infrastructure-as-code templates is also advised over manual remediation. The broader lesson: as offensive AI adoption accelerates, defenders must adopt equally integrated, automated response capabilities to counter fragmented, tool-by-tool defenses.