Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

Amazon’s threat intelligence team revealed a sustained, multi-year cyber campaign orchestrated by the Russian GRU (APT44) between 2021 and 2025, targeting Western energy and critical infrastructure. The campaign focused on exploiting misconfigured network edge devices, impacting organizations across North America, Europe, and the Middle East.

Why This Matters

Ideal security models assume proactive patching and robust network configurations; however, real-world deployments often lag, leaving systems vulnerable. This campaign demonstrates a shift towards exploiting easily-discoverable misconfigurations – a lower-risk, high-reward tactic for attackers. The potential scale of disruption to critical infrastructure, and the associated economic and societal costs, makes this a significant threat, as evidenced by past attacks like the Colonial Pipeline ransomware incident in 2021.

Key Insights

• APT44 Infrastructure Overlap: Amazon found infrastructure overlaps with known GRU-linked threat actor APT44, also known as FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear.
• Shift to Misconfigurations: Attackers moved from relying on zero-day exploits to exploiting readily available misconfigurations in network edge devices, reducing risk and resource expenditure.
• Credential Harvesting Focus: The campaign prioritizes credential harvesting via packet capture on compromised network devices, enabling lateral movement and deeper network access.

Working Example

(No code provided in the context)

Practical Applications

• Use Case: Energy companies relying on third-party managed network appliances experienced compromised devices used to intercept credentials for access to operational technology (OT) systems.
• Pitfall: Failing to regularly audit network edge devices for exposed management interfaces and unnecessary packet capture capabilities can provide attackers with a foothold.

References:

• https://thehackernews.com/2025/12/amazon-exposes-years-long-gru-cyber.html