Threat Actors Target AWS EC2 Workloads to Steal Credentials

Recently, we came across an exploitation attempt leveraging monitoring and visualization tool Weave Scope to enumerate the AWS instance metadata service (IMDS) from EC2 instances through environment variables and the IMDS endpoint.