AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH2026

Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

94Reachable catalog records

1 / 4Current catalog page

24Maximum records per page

0Samples downloaded by this page

94 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED

REPORT1 SOURCE

Prevent Expensive AWS API Actions with SCPs

Avoid AWS bill surprises by blocking known-expensive API calls with an SCP.

First reported Jul 30, 2024 00:15 UTCOpen evidence record

REPORT1 SOURCE

AWS Organizations Defaults & Pivoting

How to abuse AWS Organizations' default behavior and lateral movement capabilities.

First reported Nov 05, 2022 00:02 UTCOpen evidence record

REPORT1 SOURCE

Modify GuardDuty Configuration

Modify existing GuardDuty configurations in the target account to hinder alerting and remediation capabilities.

First reported Jan 30, 2022 10:32 UTCOpen evidence record

REPORT1 SOURCE

Security and Constraints

Security considerations and constraints that are unique to GCP

First reported May 29, 2022 13:26 UTCOpen evidence record

REPORT1 SOURCE

GCP Cloud Workstations Privilege Escalation

Break out of a Cloud Workstations container through an exposed Docker socket, then access project credentials from instance metadata.

First reported Feb 09, 2026 22:33 UTCOpen evidence record

REPORT1 SOURCE

Terraform ANSI Escape

Using ANSI Escape Sequences to Hide Malicious Terraform Code

First reported Jul 09, 2022 00:02 UTCOpen evidence record

REPORT1 SOURCE

Role Chain Juggling

Keep your access by chaining assume-role calls.

First reported Feb 03, 2021 03:20 UTCOpen evidence record

REPORT1 SOURCE

Exfiltrating S3 Data with Bucket Replication Policies

Backdooring S3 buckets with Bucket Replication Policies.

First reported Jan 26, 2023 01:02 UTCOpen evidence record

REPORT1 SOURCE

Enumerate Root User Email Address from the AWS Console

Identify if an email address belongs to the root user of an AWS account.

First reported May 21, 2024 20:10 UTCOpen evidence record

REPORT1 SOURCE

IAM Rogue OIDC Identity Provider Persistence

Obtain persistence by creating a rogue OIDC Identity Provider.

First reported Mar 06, 2025 14:44 UTCOpen evidence record

REPORT1 SOURCE

Anonymous Blob Access

Finding and accessing files stored in Azure Storage Accounts without authentication.

First reported Mar 19, 2022 16:57 UTCOpen evidence record

REPORT1 SOURCE

[Deprecated] Enumerate Permissions without Logging to CloudTrail

Leverage a bug in the AWS API to enumerate permissions for a role without logging to CloudTrail and alerting the Blue Team.

First reported May 18, 2021 19:13 UTCOpen evidence record

REPORT1 SOURCE

IAM unique identifiers

Chart of the IAM unique ID prefixes.

First reported Jul 27, 2020 19:47 UTCOpen evidence record

REPORT1 SOURCE

Create a Console Session from IAM Credentials

How to use IAM credentials to create an AWS Console session.

First reported Feb 20, 2023 16:48 UTCOpen evidence record

REPORT1 SOURCE

Bypass Credential Exfiltration Detection

When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.

First reported Jul 22, 2020 02:58 UTCOpen evidence record

REPORT1 SOURCE

Terraform Enterprise: Attack the Metadata Service

Leverage a default configuration in Terraform Enterprise to steal credentials from the Metadata Service

First reported Dec 23, 2021 21:59 UTCOpen evidence record

REPORT1 SOURCE

Discover secrets in public AMIs

How to find public AMIs and get stored secrets.

First reported May 28, 2024 16:27 UTCOpen evidence record

REPORT1 SOURCE

S3 File ACL Persistence

Maintain access to S3 resources by configuring Access Control Lists associated with S3 Buckets or Objects.

First reported Apr 13, 2021 02:53 UTCOpen evidence record

REPORT1 SOURCE

Hunting GCP Buckets

How to find valid and invalid GCP Buckets using tools

First reported Aug 29, 2022 00:18 UTCOpen evidence record

REPORT1 SOURCE

Obfuscated Admin IAM Policy

Using IAM action wildcards to create policies that grant admin-equivalent access while evading name-based detections.

First reported Mar 23, 2026 22:12 UTCOpen evidence record

REPORT1 SOURCE

2025 Hacking the Cloud: Year in Review

An end of year summary for Hacking the Cloud in 2025.

First reported Jan 04, 2026 20:47 UTCOpen evidence record

REPORT1 SOURCE

Introduction to the Instance Metadata Service

An introduction to the Instance Metadata Service and how to access it.

First reported Dec 20, 2020 20:10 UTCOpen evidence record

REPORT1 SOURCE

Hacking The Cloud

The encyclopedia for offensive security in the cloud

First reported Nov 30, 2021 05:00 UTCOpen evidence record

REPORT1 SOURCE

2022 Wrap-up

An end of year summary for Hacking the Cloud in 2022.

First reported Dec 14, 2022 03:27 UTCOpen evidence record

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.