KMON_NOC Credential Harvesting Platform: AWS Token-Jacking for Amazon Bedrock LLM Access — OTX Pulse Analysis

Threat Summary

Recent OTX pulse data reveals a targeted campaign focused on harvesting and validating AWS credentials, specifically for unauthorized access to Amazon Bedrock's large language model (LLM) capabilities. The platform KMON_NOC has been identified as a key tool used by attackers to test stolen AWS keys for Bedrock access by first validating credentials via GetCallerIdentity, then probing Bedrock permissions through ListFoundationModels and related API calls. This indicates a shift in attacker objectives from traditional data exfiltration to leveraging cloud AI services for illicit purposes, including potential model abuse, data poisoning, or cost exploitation.

The attack chain typically begins with the compromise of AWS access keys through phishing, exposed credentials in code repositories, or third-party breaches. Once harvested, these credentials are fed into automated platforms like KMON_NOC to determine their validity and scope, with a specific focus on Bedrock permissions. The ultimate goal appears to be unauthorized use of Anthropic Claude and other foundation models for malicious activities, representing an emerging threat vector in cloud security.

Threat Actor / Malware Profile

Platform: KMON_NOC (Credential Harvesting/Validation Platform)

Distribution Method: While KMON_NOC itself is a post-compromise validation tool, the AWS credentials it tests are typically obtained through:

• Phishing campaigns targeting cloud administrators
• Exposed credentials in public Git repositories or misconfigured CI/CD pipelines
• Third-party data breaches containing AWS access keys
• Infostealer malware logs sold on dark web marketplaces

Payload Behavior: The platform automates the validation of AWS credentials by:

1. Using GetCallerIdentity to confirm credential validity and extract account metadata
2. Enumerating Bedrock access via ListFoundationModels to identify available models
3. Testing model invocation capabilities to determine the full scope of compromised permissions
4. Logging validated credentials for resale or direct exploitation

C2 Communication: KMON_NOC likely operates as a centralized service or Telegram bot where attackers submit harvested credentials and receive validation results. Communication may occur over HTTPS to attacker-controlled infrastructure or through encrypted messaging platforms.

Persistence Mechanism: As a validation platform rather than endpoint malware, persistence is maintained through the attacker's infrastructure. However, validated credentials may be used to establish persistence within compromised AWS environments via IAM user creation, role assumption, or Lambda backdoors.

Anti-Analysis Techniques:

• Use of legitimate AWS API calls to blend with normal traffic
• Distributed validation to avoid rate limiting and detection
• Potential use of compromised proxies or VPNs to mask origin IPs

IOC Analysis

The provided indicators are FileHash-SHA256 values representing samples associated with the KMON_NOC platform or related tooling. SOC teams should operationalize these indicators by:

• File Hash Reputation Checks: Submit hashes to VirusTotal, Hybrid Analysis, or internal threat intelligence platforms to confirm maliciousness and gather additional context.
• EDR/AV Integration: Deploy hashes to endpoint detection and response (EDR) and antivirus solutions to block execution of known samples.
• Threat Intelligence Enrichment: Correlate hashes with other indicators (IPs, domains) in your SIEM to identify related infrastructure.
• Tooling: Use sha256sum (Linux) or Get-FileHash (PowerShell) to validate file hashes during forensic investigations. Tools like yara can be used to create custom rules for similar samples.

Detection Engineering

Sigma Rules

---
title: AWS Credential Validation for Bedrock Access
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects AWS API calls associated with credential validation and Bedrock enumeration
author: Security Arsenal
date: 2026/11/08
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'bedrock.amazonaws.com'
        eventName: 'ListFoundationModels'
    filter:
        userIdentity.type: 'IAMUser'
    condition: selection and not filter
level: medium
---
title: Suspicious AWS Credential Validation Activity
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects rapid succession of GetCallerIdentity and Bedrock API calls indicative of credential validation
author: Security Arsenal
date: 2026/11/08
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'GetCallerIdentity'
    timeframe: 5m
    condition: selection | count() > 5
level: high
---
title: AWS Bedrock Model Invocation from Unusual Source
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects Bedrock model invocation from IP addresses or user agents associated with known credential validation platforms
author: Security Arsenal
date: 2026/11/08
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'bedrock.amazonaws.com'
        eventName: 'InvokeModel'
    suspicious_ips:
        - '192.0.2.1'
        - '198.51.100.1'
    condition: selection and suspicious_ips
level: high

KQL (Microsoft Sentinel)

// Hunt for AWS Bedrock API calls from unusual sources or with suspicious patterns
AWSCloudTrail
| where EventSource == 'bedrock.amazonaws.com'
| where EventName in ('ListFoundationModels', 'InvokeModel', 'GetFoundationModel')
| extend UserIdentity = parse_json(UserIdentity)
| extend SourceIP = SourceIpAddress, UserAgent = UserAgent
| where SourceIP !in (known_corporate_ips) or UserAgent has_any ('python-requests', 'curl', 'KMON_NOC')
| summarize count() by SourceIP, UserAgent, UserIdentity.arn, bin(TimeGenerated, 1h)
| order by count_ desc

PowerShell IOC Hunt Script

# Hunt for KMON_NOC related artifacts on Windows endpoints
$Indicators = @(
    '923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608',
    'c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc'
)

# Check running processes for known hashes
Get-Process | ForEach-Object {
    try {
        $hash = (Get-FileHash -Path $_.Path -Algorithm SHA256 -ErrorAction Stop).Hash
        if ($Indicators -contains $hash) {
            Write-Output "[ALERT] Malicious process detected: $($_.Name) ($($_.Path)) - Hash: $hash"
        }
    } catch {}
}

# Check for suspicious network connections to AWS endpoints
Get-NetTCPConnection | Where-Object {
    $_.RemoteAddress -match '^(52|54|18|34|203)\.' -and $_.State -eq 'Established'
} | ForEach-Object {
    Write-Output "[INFO] Suspicious AWS connection: $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort)"
}

# Check for credential files in common locations
$credentialPaths = @(
    "$env:USERPROFILE\.aws\credentials",
    "$env:USERPROFILE\.aws\config",
    "$env:ProgramData\AWS\credentials"
)
foreach ($path in $credentialPaths) {
    if (Test-Path $path) {
        Write-Output "[WARNING] AWS credential file found: $path"
        $content = Get-Content $path -Raw
        if ($content -match 'aws_access_key_id') {
            Write-Output "[ALERT] AWS credentials exposed in file: $path"
        }
    }
}

Response Priorities

Immediate (0-4 hours)

• Block IOCs: Deploy the provided SHA256 hashes to EDR, AV, and email gateways to prevent execution of known KMON_NOC samples.
• Hunt for Execution Artifacts: Search endpoints for the presence of the IOC hashes and investigate any associated processes or network connections.
• Review AWS CloudTrail: Query CloudTrail logs for GetCallerIdentity, ListFoundationModels, and InvokeModel events from unusual source IPs or with suspicious user agents.

24 Hours

• Credential Rotation: If any AWS credentials are suspected to be compromised, immediately rotate access keys and enforce MFA on all IAM users.
• Identity Verification: Audit IAM users, roles, and policies for unauthorized changes or suspicious activity. Verify the legitimacy of all recent API calls, especially those involving Bedrock.
• Network Segmentation: Restrict outbound access to AWS Bedrock endpoints to only authorized users and systems.

1 Week

• Architecture Hardening: Implement least-privilege access for AWS credentials, ensuring that Bedrock permissions are only granted to necessary roles.
• Monitoring Enhancement: Deploy custom detection rules (Sigma, KQL) to alert on abnormal AWS API usage patterns, particularly rapid credential validation attempts.
• User Awareness Training: Educate developers and cloud administrators on the risks of exposed credentials and the importance of secure key management practices.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub