Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
66 IOCs
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
Malware Families
Excerpt
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access | Datadog Security Labs Security Labs ARTICLES CLOUD SECURITY ATLAS NEWSLETTER ABOUT ARTICLES CLOUD SECURITY ATLAS NEWSLETTER ABOUT research Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access October 6, 2026 aws threat research twitter reddit on this page Credential validation tooling observed in the wild KMON_NOC Other credential harvesting applications Amazon…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →66 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 85.253.221.206 | High | Score 58/100 | First seen |
| IP | 172.56.122.32 | High | Score 58/100 | First seen |
| IP | 84.50.134.231 | High | Score 58/100 | First seen |
| IP | 206.206.119.201 | High | Score 58/100 | First seen |
| IP | 51.15.192.215 | High | Score 58/100 | First seen |
| IP | 200.151.53.165 | High | Score 58/100 | First seen |
| IP | 94.154.46.245 | Medium | Score 45/100 | First seen |
| IP | 59.92.240.165 | High | Score 58/100 | First seen |
| IP | 190.56.117.218 | High | Score 58/100 | First seen |
| IP | 45.11.61.22 | High | Score 58/100 | First seen |
| IP | 128.116.206.252 | High | Score 58/100 | First seen |
| IP | 94.154.46.243 | High | Score 80/100 | First seen |
| IP | 186.154.182.44 | High | Score 58/100 | First seen |
| IP | 94.154.46.248 | Medium | Score 60/100 | First seen |
| IP | 94.154.46.246 | High | Score 58/100 | First seen |
| IP | 72.235.197.91 | High | Score 58/100 | First seen |
| IP | 151.243.18.111 | High | Score 83/100 | First seen |
| IP | 89.249.72.22 | High | Score 58/100 | First seen |
| IP | 194.36.27.53 | High | Score 58/100 | First seen |
| IP | 82.86.130.180 | High | Score 58/100 | First seen |
| IP | 95.216.34.254 | High | Score 58/100 | First seen |
| IP | 79.117.129.254 | High | Score 58/100 | First seen |
| IP | 71.76.4.45 | High | Score 58/100 | First seen |
| IP | 98.44.224.55 | High | Score 58/100 | First seen |
| IP | 94.154.46.247 | Medium | Score 72/100 | First seen |
| IP | 88.167.240.60 | High | Score 58/100 | First seen |
| IP | 173.249.254.173 | High | Score 58/100 | First seen |
| IP | 157.100.141.65 | High | Score 58/100 | First seen |
| IP | 109.146.93.39 | High | Score 58/100 | First seen |
| IP | 50.82.6.249 | High | Score 58/100 | First seen |
| IP | 191.93.177.69 | High | Score 58/100 | First seen |
| IP | 47.230.250.253 | High | Score 58/100 | First seen |
| IP | 94.154.46.242 | High | Score 77/100 | First seen |
| IP | 112.78.151.90 | High | Score 58/100 | First seen |
| IP | 216.126.227.187 | High | Score 58/100 | First seen |
| IP | 138.199.15.176 | High | Score 58/100 | First seen |
| IP | 46.100.30.188 | High | Score 58/100 | First seen |
| IP | 87.58.197.199 | High | Score 58/100 | First seen |
| IP | 85.137.53.173 | High | Score 58/100 | First seen |
| IP | 83.194.172.248 | High | Score 58/100 | First seen |
| IP | 103.148.197.54 | High | Score 58/100 | First seen |
| SHA256 | 923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608 | Medium | Score 53/100 | First seen |
| IP | 93.118.107.1 | High | Score 58/100 | First seen |
| IP | 181.51.32.38 | High | Score 58/100 | First seen |
| IP | 69.250.15.174 | High | Score 58/100 | First seen |
| IP | 108.168.65.226 | High | Score 58/100 | First seen |
| IP | 116.106.179.94 | High | Score 58/100 | First seen |
| IP | 213.186.157.53 | High | Score 58/100 | First seen |
| IP | 94.154.46.249 | High | Score 79/100 | First seen |
| IP | 85.137.52.59 | High | Score 58/100 | First seen |
| IP | 87.58.197.196 | High | Score 58/100 | First seen |
| IP | 94.154.46.250 | High | Score 76/100 | First seen |
| IP | 154.119.213.63 | High | Score 58/100 | First seen |
| IP | 137.103.56.107 | High | Score 58/100 | First seen |
| IP | 115.138.247.83 | High | Score 58/100 | First seen |
| IP | 138.94.168.132 | High | Score 58/100 | First seen |
| IP | 181.115.172.90 | High | Score 58/100 | First seen |
| IP | 103.160.185.100 | High | Score 58/100 | First seen |
| IP | 196.177.214.142 | High | Score 58/100 | First seen |
| IP | 92.144.3.108 | High | Score 58/100 | First seen |
| IP | 78.109.78.211 | High | Score 58/100 | First seen |
| SHA256 | c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc | Medium | Score 53/100 | First seen |
| IP | 146.70.173.170 | High | Score 58/100 | First seen |
| IP | 192.74.128.184 | High | Score 58/100 | First seen |
| IP | 173.92.116.211 | High | Score 58/100 | First seen |
| IP | 92.216.157.153 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…