Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials

A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IAM) credentials from the IMDSv1 endpoint. Retrieving IAM credentials allows attackers to escalate their privileges and access S3 buckets or control other AWS services, potentially leading to sensitive data exposure, manipulation, and service disruption. The campaign was discovered by F5 Labs researchers, who reports that the malicious activity culminated between March 13 and 25, 2025. The traffic and behavioral patterns strongly suggest that it was carried out by a single threat actor. SSRF problems are web flaws that enable attackers to "trick" a server into making HTTP requests to internal resources on their behalf, which usually are not accessible by the attacker. In the campaign observed by F5, the attackers located websites hosted on EC2 with SSRF flaws, allowing them to remotely query the internal EC2 Metadata URLs and receive sensitive data. EC2 Metadata is a service in Amazon EC2 (Elastic Compute Cloud) that provides information about a virtual machine running on AWS. This information can include configuration details, network settings, and potentially, security credentials. This metadata service is only accessible by the virtual machine by connecting to special URLs on internal IP addresses, like http://169.254.169.254/latest/meta-data/. The first malicious SSRF probe wa...