2026 Critical Cloud Control Plane Detection: Newly Created Access Key Used Immediately from an Unfamiliar Location

Ibrahim Saud@tektrix

•updated 5 days ago•0•0•0

Detects a rapid burst of read-only IAM and STS API enumeration calls originating from a single source IP address within a one-minute window. This behavior is indicative of automated reconnaissance tools (e.g., enumerate-iam, Pacu) used in the early stages of a cloud attack to identify permissions and potential targets for privilege escalation.