A sophisticated campaign targeting AWS EC2 instances has been discovered by F5 Labs researchers, with peak activity occurring between March 13-25, 2025. The attackers exploited Server-Side Request Forgery (SSRF) vulnerabilities to extract sensitive EC2 Metadata, including IAM credentials from IMDSv1 endpoints.
## How the Attack Works
SSRF vulnerabilities allow attackers to manipulate servers into making HTTP requests to internal resources that would normally be inaccessible. In this campaign, attackers identified websites hosted on EC2 instances with SSRF flaws, enabling them to query internal EC2 Metadata URLs at addresses like http://169.254.169.254/latest/meta-data/.
The campaign began with initial probes on March 13 before escalating between March 15-25. Attackers operated from multiple IPs based in France and Romania through FBW Networks SAS. They systematically rotated through six query parameter names (dest, file, redirect, target, URI, URL) and four subpaths to maximize data exfiltration from vulnerable sites.
## Why It’s Dangerous
Successfully obtaining IAM credentials allows attackers to:
– Escalate privileges within AWS environments
– Access sensitive S3 bucket data
– Control other AWS services
– Potentially expose, manipulate, or disrupt critical services
The attacks were successful primarily against instances running IMDSv1, AWS’s older metadata service that lacks the authentication requirements implemented in IMDSv2.
## Broader Exploitation Trends
F5 Labs’ March 2025 threat report highlighted this campaign alongside other significant exploitation activities. The most targeted vulnerabilities by volume were:
1. CVE-2017-9841 – PHPUnit remote code execution (69,433 attempts)
2. CVE-2020-8958 – Guangzhou ONU OS command injection (4,773 attempts)
3. CVE-2023-1389 – TP-Link Archer AX21 command injection (4,698 attempts)
4. CVE-2019-9082 – ThinkPHP PHP injection (3,534 attempts)
Notably, 40% of exploited CVEs were over four years old, demonstrating that older vulnerabilities remain highly targeted.
## Mitigation Recommendations
To protect against these threats, organizations should:
– Apply available security updates promptly
– Harden router and IoT device configurations
– Replace end-of-life networking equipment
– Upgrade to IMDSv2 for EC2 instances to prevent SSRF attacks