After gaining access, the attacker enumerated cloud resources, including S3 buckets, databases, EC2 instances, security groups and IAM identities. The intruder also accessed AWS Secrets Manager, Systems Manager Parameter Store and Lambda function configurations to retrieve credentials and other sensitive information.
Attackers stole data, and hosted a suspicious Linux image
The attacker used the assumed roles to download data from Amazon S3, enumerating accessible buckets and objects before retrieving their contents. In some instances, Wiz said, entire buckets were downloaded in individual sessions.
Credentials discovered in the compromised environments were subsequently tested using TruffleHog, a secrets-scanning tool. These included AWS access keys, Microsoft Entra ID service principal credentials and Okta OAuth client credentials.
