Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

Amazon's threat intelligence team has disclosed details of a years-long Russian state-sponsored campaign that targeted Western critical infrastructure between 2021 and 2025, focusing on energy sector organisations, North American and European providers, and cloud-hosted network infrastructure. The activity is attributed with high confidence to the GRU-affiliated APT44, also known as FROZENBARENTS, Sandworm, Seashell Blizzard and Voodoo Bear.

It prominently utilised misconfigured customer network edge devices with exposed management interfaces as an initial access vector, while evidence shows a shift away from frequent N-day and zero-day exploits toward targeting critical infrastructure.

The attackers exploited vulnerabilities including CVE-2022-26318, CVE-2021-26084, CVE-2023-22518 and CVE-2023-27532, and engaged in credential harvesting and credential replay to move laterally across victim networks, using persistent connections to compromised EC2 instances. Amazon notes coordinated attempts on misconfigured edge devices hosted on AWS infrastructure and suggests auditing network edge devices, strengthening authentication, and monitoring for credential replay attacks.

The intrusion set also overlaps with Bitdefender-disclosed Curly COMrades, raising the possibility of complementary GRU operations across separate clusters.