AWS Updates Threat Technique Catalog with Focus on Container Security and EKS Threats

The AWS Customer Incident Response Team (CIRT) recently published its June 2026 update to the Threat Technique Catalog (TTC), a crucial resource designed to help AWS users understand and defend against contemporary cyber threats. This latest iteration of the catalog brings a sharp focus to three critical areas: container security, the exploitation of organization-level trust, and compute hijacking. The update is a direct response to patterns and techniques consistently observed by the AWS CIRT during their engagements with customers responding to security incidents. By sharing these real-world insights, AWS aims to equip organizations with the knowledge necessary to proactively improve their security defenses. A significant portion of the new entries in the catalog pertains to the growing attack surface presented by containerized environments. Specifically, the June 2026 update highlights that malicious actors are increasingly concentrating their efforts on compromising container orchestration platforms. Amazon Elastic Kubernetes Service (EKS) is explicitly mentioned as a target, indicating a trend where the widespread adoption of Kubernetes at scale correlates with an expanded attack surface. Threat actors are becoming more sophisticated, leveraging legitimate functionalities within these environments to achieve their objectives. Furthermore, the catalog addresses techniques that exploit organizational trust relationships. This means attackers are adept at understanding how trust is established and managed across different accounts and services within an AWS environment, and then using these relationships to their advantage. The common thread across all new techniques is that they often operate within the boundaries of what might be considered legitimate actions, such as modifying a workload, assuming cross-account trust, or joining an organization. This subtlety makes detection and prevention more challenging, necessitating a deeper understanding of these attack vectors. By detailing these techniques and providing straightforward mitigation advice, the AWS CIRT empowers customers to better protect their cloud infrastructure, particularly their containerized applications and orchestration systems, against sophisticated and evolving threats. The ultimate goal is to foster a more secure cloud ecosystem by making critical threat intelligence accessible and actionable for all AWS users.