8 Minutes to Admin: Why Your Cloud Detection Window Just Vanished

“Time is your greatest enemy” — Top Gun: Maverick

By Aeris Virelai | Caduceus Security Group Research

In the world of Cloud DFIR, we often talk about “dwell time” in terms of days or weeks. But a recent report from the Sysdig Threat Research Team (TRT) has just reset the clock for everyone.

On November 28, 2025, an attacker went from initial access to full administrative privileges in an AWS environment in under 10 minutes. The “admin moment” — the point where the attacker gained the keys to the kingdom — happened at approximately the 8-minute mark.

This wasn’t a sophisticated zero-day. It was a relentless, machine-speed execution of classic cloud misconfigurations.

The Anatomy of an 8-Minute Breach

The attack chain followed a path that many organizations still consider “low risk” until it’s too late:

1. The Foothold: Valid test credentials were discovered in a public S3 bucket. These weren’t admin keys, but they were enough to get in the door.
2. The Acceleration: Using indicators consistent with LLM-assisted automation, the attacker performed massive reconnaissance across 19 unique AWS principals. They didn’t pause to “figure out” the environment; they iterated at machine speed.
3. The Escalation: The attacker identified an over-permissioned Lambda function (EC2-init). By injecting malicious code and updating the function configuration, they minted new access keys for an administrative user.
4. The Impact: Once admin access was secured, the actor pivoted to LLMjacking via Amazon Bedrock and provisioned high-performance GPU instances (p4d.24xlarge) for resource abuse.

The “Time” Advantage is Dead

Historically, defenders relied on attacker friction. We assumed that moving from a low-privilege key to a full admin compromise would take hours of manual scripting, trial-and-error, and human hesitation.

AI has eliminated that hesitation.

When an attacker uses LLMs to interpret error messages, generate exploit code, and automate lateral movement, the decision-making loop collapses. If your incident response plan relies on a human noticing an alert, opening a ticket, and “investigating” before taking action, you are betting against an 8-minute clock. You will lose that bet every time.

The Caduceus Takeaway: Defensive Imperatives

At Caduceus Security Group, we believe that in the era of AI-accelerated attacks, your first 10 minutes must be pre-planned and largely automated.

• Identity is the Perimeter: If your Lambda deployment permissions allow for code mutation and role-passing without strict guardrails, you don’t have a “dev” problem; you have an admin-equivalent vulnerability.
• Guardrails Over Alerts: Detection without response is just a front-row seat to your own disaster. Use Service Control Policies (SCPs) to restrict high-risk actions (like GPU provisioning or unapproved Bedrock model invocations) before they happen.
• Runtime is the New Ground Truth: You must monitor for “credential minting” behaviors. When a Lambda function suddenly starts creating IAM access keys, the response must be near-instantaneous.

The 8-minute compromise is a warning shot. AI doesn’t change the rules of cloud security, but it has fundamentally changed the speed.

Is your response window measured in minutes, or are you still operating in hours?

Aeris Virelai is a specialist in behavioral correlation, cloud forensics, and the intersection of human intuition with machine intelligence. As a lead researcher for Caduceus Security Group, she focuses on translating complex telemetry into actionable narratives, ensuring that even in an era of machine-speed attacks, the human element remains the ultimate fail-safe.