AWS Updates Threat Technique Catalog for June 2026: Focus on Container, Org Trust, and Compute Security

The AWS Customer Incident Response Team (CIRT) has published its June 2026 update to the Threat Technique Catalog (TTC), a vital resource designed to help AWS customers bolster their defenses against prevalent security threats. This latest iteration of the catalog, released on June 29, 2026, incorporates new techniques observed by the CIRT during incident response engagements, focusing on critical areas such as container security, organization-level trust, and compute hijacking. The overarching goal is to make actionable security intelligence accessible, enabling organizations to improve their resilience to disruptions. The update introduces five new entries, each reflecting real-world attack patterns encountered by AWS CIRT. One significant addition is 'EKS workload modification.' This technique describes scenarios where threat actors, having obtained Kubernetes credentials or an AWS Identity and Access Management (IAM) role with EKS permissions, modify existing workloads. Instead of creating new resources, attackers alter container images, inject sidecar containers, or change pod specifications to introduce malicious code. This method allows them to inherit the legitimate workload's network access, service account permissions, and data access, often going unnoticed without proper admission controllers or image verification. Another highlighted technique is the 'Exploit public-facing application – EKS.' This addresses the persistent issue of publicly exposed Kubernetes API servers and misconfigured ingress controllers serving as entry points for attackers. The pattern typically involves exploiting a weakness in an exposed service, then pivoting from a compromised pod to gain broader cluster access. Once inside a pod, threat actors can leverage the instance metadata service, read mounted service account tokens, or move laterally across the cluster network. The catalog also details 'Assume root into organization member account,' a technique that exploits the inherent trust model within AWS Organizations. Attackers who compromise a management account or gain sufficient privileges within one can use this position to assume root access into member accounts via `sts:AssumeRoot`. This bypasses access controls configured by member account administrators, underscoring the critical importance of securing the management account. Each new entry in the TTC is accompanied by straightforward mitigation strategies, providing customers with immediate steps to counter these threats. By understanding these techniques, organizations can proactively implement controls, configure monitoring, and develop incident response plans that are aligned with current threat landscapes. The AWS CIRT emphasizes that continuous vigilance and adaptation of security practices are essential in maintaining a strong security posture in the cloud.