T1485.A002: AMI Image Deletion

aws-samples.github.io • April 28, 2026

AMIs (Amazon Machine Image) are templates that contain software configurations (including the operating system, application server, and applications) and can be used to launch EC2 instances, making them essential resources for disaster recovery and system restoration. An adversary can leverage access to delete AMIs to damage an organization or their customers.Threat actors may use the ec2:DeregisterImage API call to remove AMIs from an AWS account. After deregistration, these AMIs become unavailable for launching new EC2 instances

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit AWS Cognito Refresh Tokens for Persistent Access In April 2026, AWS reported that threat actors are exploiting Amazon Cognito refresh tokens to maintain unauthorized access to applications. These tokens, which can be valid for up to 10 years, allow attackers to generate new access tokens without re-authenticating. The initial access is typically gained through credential theft or compromised client-side storage. This method enables attackers to remain undetected while continuing to access resources even after the original access tokens expire. The AWS Cyber Incident Response Team (CIRT) noted that environments without refresh token rotation are particularly vulnerable, as the same token can be reused indefinitely. Additionally, threat actors have been observed deregistering Amazon Machine Images (AMIs) to hinder recovery efforts. The updates to the Threat Technique Catalog (TTC) include new methods for detecting these activities and recommendations for mitigation. 2 sources 69

Extracted Entities

T1485.A002: AMI Image Deletion

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)