AI-assisted cyberattacks escalate cloud security threats in China
Security researchers reported that AI-driven cyberattacks in 2025 showed increased sophistication, with attackers using AI to generate malicious code and craft phishing emails. A detailed case study described how attackers compromised AWS cloud environments within 10 minutes by exploiting credential exposure and leveraging AI models to escalate privileges and access sensitive data.
What happened
In 2025, Ruixin reported that cyberattacks escalated with attackers using AI to automatically generate malicious code and construct high-fidelity phishing emails, significantly lowering the attack threshold. The Yinhu remote control trojan family demonstrated strong adversarial capabilities and rapid iteration, with attackers masquerading as frequently-used software like WPS office and Sogou input method.
Sysdig researchers documented a case in which attackers compromised AWS cloud environments and obtained administrator privileges within 10 minutes by accessing credentials stored in Amazon S3 buckets, then leveraging multiple techniques to escalate access. The attackers used stolen IAM credentials for AWS Lambda, Bedrock, and other services to move laterally across 19 AWS accounts, accessing model repositories, GPU resources, and sensitive data.
Reported impact
Researchers observed that attackers maintained persistent access across multiple AWS accounts and stole data including AWS Secrets Manager credentials, EC2 system information, SSM parameters, CloudWatch logs, Lambda function code, custom S3 bucket contents, and CloudTrail logs. Lambda execution time increased from 3 seconds to 30 seconds, indicating resource hijacking during AI model generation.
Index analysis
Ruixin's 2025 report found that trojan viruses comprised 73.35% of malware threats, while ransomware shifted toward targeted 'double extortion plus' tactics combining data theft and sensitive information auctions. The report predicted that in 2026, AI technology would further integrate into both attack and defense, with AI-driven automated vulnerability discovery potentially shortening zero-day response times and increasing defensive pressure.
Governance controls
Sysdig recommended preventing credential exposure by managing IAM role credentials with temporary credentials in IAM user organization structures, ensuring only authorized personnel hold such credentials. For Lambda functions, they advised implementing privilege escalation monitoring and restricting permissions to UpdateFunctionCode and UpdateFunctionConfigurationonly when necessary.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.