Today’s look-out: Cloud account takeover risk (leaked keys) and trusted security tooling being abused
What to look out for today
Two themes to keep on your radar today:
- Cloud account takeover from leaked credentials: reports highlight thousands of publicly exposed AWS access keys that are still active and usable.
- “Trusted tool” abuse on Windows: research shows a way a legitimate Microsoft Defender boot-time driver could be misused to delete or disable security software during boot, potentially making attacks (including ransomware) easier to run and harder to stop.
Why this matters to smaller businesses
- AWS key exposure can be business-ending quickly: attackers with valid keys may access data, create new users, spin up costly resources, or quietly set up persistence—often without triggering obvious “password failed” alerts.
- Security software removal changes the game: if an attacker can knock out endpoint protection, incidents can escalate faster (encryption, data theft, fraud), and recovery may take longer.
- SMEs rely on third parties: outsourced IT, MSPs, developers, and contractors often handle cloud keys and device management—so the risk can sit outside your direct view.
Warning signs
- AWS / cloud: unexpected new users/roles, access keys created, policies changed, MFA settings altered, logins from unfamiliar locations, or sudden cost spikes.
- Windows / endpoints: security tools suddenly disabled or missing after a reboot, unusual “tamper protection” alerts, endpoints dropping out of management dashboards, or repeated reboot loops around the time an incident starts.
- People/process: developers or suppliers asking to “share a key quickly”, credentials found in shared documents, code repos, ticket comments, or chat threads.
How attackers may exploit the situation
- Leaked cloud keys: attackers search public places (e.g., shared code, pasted snippets, misconfigured storage, build logs) for credentials and test whether they still work. If they do, they may move fast to create backup access and hide activity.
- Disable defences before the main attack: some attackers prioritise neutralising endpoint protection first, then deploy payloads, steal data, or attempt ransomware. Using legitimate components can make activity harder to spot at a glance.
What to do today
- Audit cloud credentials: identify who/what still uses long-lived AWS access keys; rotate keys that aren’t essential; disable any keys not used recently; and ensure MFA is enforced where applicable.
- Hunt for exposed secrets: ask your technical team/MSP to check whether your organisation’s keys have appeared in public code repos, build logs, or shared “how-to” docs.
- Put spend and access guardrails in place: confirm you have cost alerts, logging/monitoring enabled, and notifications for new users/keys and permission changes.
- Check endpoint tamper controls: confirm your endpoint security platform is configured to alert on disablement/uninstall events and that those alerts go to more than one mailbox/person.
- Rehearse your ‘containment’ step: ensure you can quickly isolate devices and revoke cloud credentials during an incident (and know who can approve that decision).
Ask your IT provider
- Do we have an up-to-date list of all AWS access keys in use (including by suppliers, scripts, and legacy apps), and when they were last used?
- What monitoring do we have for new cloud access keys, new privileged users/roles, and permission changes—and who gets alerted?
- Have we scanned our code repos and build pipelines for embedded secrets (keys/tokens)? How often do we repeat that scan?
- On Windows endpoints, what controls are in place to detect or prevent security tool removal/disablement, especially around reboot/boot-time activity?
- If we suspected an active attack, what is our fastest path to: revoke cloud credentials, isolate machines, and preserve logs for investigation?
Patch watch - only one short paragraph, and only if relevant
This brief is less about applying a specific patch and more about credential hygiene and monitoring. However, it’s still worth confirming your normal Windows update and endpoint-management process is healthy, because attackers often take advantage of organisations that are behind on baseline maintenance and visibility.
One action today
Today, inventory and rotate/disable any AWS access keys that are not strictly required (especially unused or unknown keys), and ensure alerts are enabled for new keys and permission changes.
Related Actions On Cyber resource
Actions On Cyber checklist: “Cloud account takeover prevention (MFA, access keys, logging and spend alerts)”
Sources
- Hundreds of leaked AWS keys give full control over corporate accounts (BleepingComputer)
- Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.