By 
A password-spraying campaign targeting highly privileged AWS root accounts has been observed across more than 150 organizations, raising fresh concerns about how attackers are approaching cloud infrastructure. Datadog Security Research identified the activity between July 24 and August 23, 2026, recording repeated failed authentication attempts against AWS root users.
The campaign did not appear to be limited to a particular industry or geography. Datadog said the targeted organizations varied widely by country and sector, making it difficult to establish a clear victim profile or determine the attackers’ ultimate objective.
The researchers have not observed a successful authentication attempt, meaning there is currently no evidence from the campaign that attackers gained access through these attempts. Even so, the focus on AWS root accounts makes the activity significant.
Why AWS Root Accounts Are a High-Value Target
The AWS root user is the identity created when an AWS account is first registered. It has complete access to the account’s resources, billing information and settings, including certain operations that cannot be performed by other identities.
That level of privilege makes a compromised root account particularly dangerous. An attacker who successfully obtains the credentials could potentially gain control over a company’s cloud environment rather than being restricted to an individual application or user account.
AWS itself recommends avoiding routine use of the root account and using other identities with appropriate permissions for everyday administration.
The campaign therefore illustrates a familiar cybersecurity principle: attackers don’t always need to exploit a sophisticated software vulnerability if they can find a way to compromise a highly privileged identity.
Password Spraying Rather Than Traditional Brute Force
Datadog described the activity as password spraying, a technique in which attackers try commonly used passwords across many accounts rather than repeatedly attempting large numbers of passwords against a single account.
That distinction matters because password spraying can make attacks less obvious and reduce the likelihood of triggering account-specific defenses.
Researchers observed a median of two attempts per targeted organization, while some organizations experienced as many as eight attempts during the campaign window. The authentication requests were also routed through proxies, with source IP addresses spread across different countries and networks.
The attackers appear to have already possessed, or attempted to discover, the email addresses associated with AWS root accounts. Datadog noted that generating a failed root-user console login requires the email address tied to the AWS account.
That creates another important security consideration: protecting the root account also means protecting the corporate email infrastructure and account-recovery mechanisms associated with it.
MFA Helps, but Monitoring Still Matters
AWS has strengthened protections around root users, including mandatory MFA requirements for root users across account types, with a grace period for registration.
But MFA should not be treated as the only defense.
AWS recommends using the root user only when a task specifically requires it, avoiding root access keys, securing recovery channels and monitoring root activity. Organizations using AWS Organizations can also centralize root access and remove persistent root credentials from member accounts where appropriate.
Datadog recommends paying particular attention to failed and successful root-user sign-ins in CloudTrail, as well as credential changes and other activity involving the root identity.
For organizations running significant workloads in AWS, the latest campaign is a reminder that cloud security isn’t only about protecting applications and APIs. The identities sitting above those systems can be even more valuable to attackers.
There is no evidence that this particular campaign successfully compromised the targeted AWS accounts, but the repeated attempts show that attackers are actively testing one of the most powerful doors into cloud infrastructure. For companies relying on AWS, securing and monitoring the root account should be treated as a priority rather than an administrative afterthought.
Comments