Pacu is a modular AWS exploitation framework that automates post-exploitation activity against misconfigured cloud accounts. Attackers use it to enumerate permissions, abuse overprivileged roles, test access paths, and chain AWS actions into persistence or data theft. Defenders should review IAM least privilege, monitor unusual API calls, and alert on privilege escalation patterns.
How Pacu turns AWS misconfiguration into repeatable post-exploitation
Pacu is built to automate the actions an attacker would normally perform by hand after obtaining AWS access. Rather than being a single exploit, it is a modular framework that chains discovery, permission checking, privilege escalation, persistence, and data-access techniques into reusable modules that can be run against one account or many.
That modular design matters because AWS compromise is usually about access paths, not one vulnerable binary. Pacu helps an operator answer practical questions quickly: what can this principal actually do, what other roles can it reach, and which AWS actions can be combined to widen access or extract data.
In practice, the framework works by using the permissions already available to the current identity. If the role or user is overprivileged, Pacu can enumerate the reachable AWS surface, test what is allowed, and try a series of actions that are commonly useful for follow-on abuse. It is effective precisely when IAM is loose, trust relationships are broad, and logging or detection is weak. For AWS defenders, the relevant baseline is the AWS Security Guide, which frames the controls Pacu tends to pressure, such as least privilege, access-key hygiene, CloudTrail visibility, and account-level guardrails.
What Pacu typically does after initial AWS access
A common Pacu workflow starts with enumeration. The framework checks the caller’s identity, policies, attached permissions, and reachable services, then runs modules that test whether those permissions can be turned into something more useful. That may include reading metadata about users and roles, probing for ways to assume another role, and identifying services that accept writes or sensitive reads from the current principal.
From there, Pacu can move into privilege escalation and persistence. The same access that looks harmless in a console may permit policy changes, new access keys, trust-policy edits, Lambda or IAM abuse, or other actions that make the initial foothold harder to remove. In mature environments, the interesting question is not whether the tool can run, but whether the current permissions and trust relationships leave enough room for it to succeed.
Pacu also supports data-theft style workflows. If the identity can reach S3, snapshots, parameter stores, secrets, or other exposed resources, the framework can accelerate discovery and access patterns that lead to exfiltration. The tool is therefore useful to attackers and red teams for the same reason: it turns a fragmented AWS permission set into a guided sequence of abuse paths.
Why Pacu succeeds when AWS control design is weak
Pacu is most dangerous when defenders treat AWS permissions as static configuration rather than an active attack surface. Overprivileged roles, stale access keys, permissive trust policies, and weak separation between environments all expand what the framework can do once it is inside an account. The attacker’s advantage is not exotic code execution, it is the ability to compose ordinary AWS actions into a larger compromise.
Detection gaps matter just as much. If CloudTrail events are incomplete, alerts are noisy, or privilege escalation patterns are not monitored, Pacu activity can blend into routine administration. The same is true when organisations lack a clear inventory of who can assume which roles, create which keys, or modify which policies. In that situation, the framework becomes a fast way to discover the organisation’s hidden trust graph.
Risk and Threat Considerations
Pacu is a practical example of how cloud compromise often scales through authorization, not malware. Once an attacker has any valid AWS foothold, the main risk is that the current identity can be used to enumerate, expand, and persist before defenders notice the pattern.
Failure mechanism: Misconfigured IAM allows the framework to test reachable actions, discover escalation paths, and chain benign-looking AWS operations into broader access or exfiltration.
Impact: A single compromised principal can become account-wide persistence, data theft, or a launch point for lateral movement across related cloud resources.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Pacu abuses excessive AWS permissions and reachable actions. |
| AU-2 — Event Logging | Pacu-style activity is often detected through unusual API and identity events. | |
| IA-5 — Authenticator Management | Pacu impact can be amplified when keys and other authenticators are long-lived or exposed. | |
| Recommendation — Enforce least privilege to reduce what a compromised AWS identity can execute. Log key AWS API and IAM events needed to spot escalation and persistence. Rotate and revoke compromised or stale credentials to shrink attacker access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Pacu targets overprivileged accounts and poor lifecycle control of AWS identities. |
| Recommendation — Review and remove unnecessary account and role access to limit post-exploitation abuse. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Pacu commonly enables persistence through identity and policy changes in cloud accounts. |
| Recommendation — Map suspicious IAM and STS changes to account manipulation and investigate persistence. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Pacu succeeds when non-human AWS identities have more access than they need. |
| Recommendation — Reduce overprivileged non-human identities to limit escalation paths. | ||
Practitioner Guidance
What to verify: Check whether the principal used in the account has unusually broad role assumption, policy attachment, key creation, or secret-access rights. If those permissions exist, assume Pacu-style enumeration can find something useful even if no obvious vulnerability is present.
What to measure: Watch for unusual bursts of IAM, STS, S3, CloudTrail, Lambda, and KMS activity from identities that normally perform limited tasks. Escalation often shows up first as a change in API mix, not as a failed login.
Decision rule: If you detect a foothold with broad AWS permissions, prioritise containment and permission reduction before deciding whether the attacker actually used every reachable action. The blast radius is determined by access, not by confirmed abuse alone.
Practitioner takeaway: Pacu works because AWS environments often expose too much authority to too many identities, so the best defense is to make reachable actions narrow, observable, and hard to repurpose.