Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

Dec 16, 2025Ravie LakshmananCloud Security / Vulnerability

Amazon’s threat intelligence team has revealed details of a Russian state-sponsored campaign targeting Western critical infrastructure from 2021 to 2025.

The campaign targeted energy sector organizations, critical infrastructure providers, and entities with cloud-hosted network infrastructure in North America and Europe, attributed to Russia’s Main Intelligence Directorate (GRU) with high confidence.

The attacks initially targeted misconfigured customer network edge devices with exposed management interfaces, transitioning to attacks on critical infrastructure over time, reducing exposure and resource expenditure.

Credential harvesting and lateral movement into victim organizations’ online services and infrastructure were the main goals of the attacks, according to CJ Moses, Chief Information Security Officer of Amazon Integrated Security.

The attacks exploited vulnerabilities in WatchGuard Firebox, XTM, Atlassian Confluence, and Veeam over the years, targeting misconfigured edge network devices and various infrastructure components.

The intrusions focused on enterprise routers, VPN concentrators, network management appliances, and cloud-based project management systems, aimed at facilitating credential harvesting at scale.

Telemetry data revealed coordinated attempts on misconfigured customer network edge devices hosted on Amazon Web Services (AWS) infrastructure.

Credential replay attacks were observed against victim organizations’ online services to gain a deeper foothold into targeted networks.

• Compromise customer network edge device on AWS
• Utilize native packet capture capability
• Replay intercepted credentials against victim organizations’ online services
• Establish persistent access for lateral movement

Credential replay operations targeted energy, technology/cloud services, and telecom providers across different regions, focusing on the energy sector’s supply chain.

There are infrastructure overlaps with another cluster known as Curly COMrades, indicating specialized subclusters within GRU’s broader campaign objectives.

Amazon notified affected customers and disrupted active threat actor operations targeting its cloud services, recommending network security measures to prevent future attacks.