A new incident analysis from Sygnia highlights how a single threat actor used AI-assisted workflows to compromise a large Amazon Web Services (AWS) environment in approximately 72 hours before attempting to extort an unnamed global enterprise. The attacker did not rely on a single cloud misconfiguration or software vulnerability, but chained together weaknesses across internet-facing applications, AWS resources, source code repositories, CI/CD pipelines, runtime environments, and data stores. The investigation found that the attacker first obtained an AWS access key through a vulnerable internet-facing application, then used AI-assisted workflows to accelerate reconnaissance, credential discovery, secrets harvesting, cloud enumeration, backdoor deployment, and data exfiltration. Sygnia observed attacker-created scripts, rapid parallel operations, and environment-specific adaptations suggesting AI was used to automate reconnaissance, tool development, and command execution. The attacker also disrupted cloud operations by restricting access to Amazon S3 buckets, limiting Amazon ECS services, blocking network traffic through access control lists, and purging Amazon SQS queues. According to Avi Dayan, Vice President of Incident Response at Sygnia, defenders can no longer depend on manual investigation of security alerts when attackers are capable of automating reconnaissance, privilege escalation, and data theft at machine speed.