AWS EC2 (Amazon Elastic Compute Cloud) is Amazon’s virtual server service. It lets customers spin up cloud machines on demand, choose IP addresses, and tear them down when finished. In security work, EC2 matters because those temporary servers can be used for legitimate testing, but they can also be abused by attackers as disposable infrastructure.
One common abuse is distributing login attempts across many EC2 source IPs. That makes password-spraying and credential-stuffing campaigns harder to block with simple IP reputation or rate limits, because the traffic appears to come from many different hosts. Defenders respond by watching identity telemetry, unusual sign-in locations, user-agent changes, and impossible-travel patterns, rather than relying only on network blocking. In short, EC2 is not the attack itself; it is a scalable platform that can help attackers hide volume and blend into normal cloud traffic.