SLTT Traffic Directing to S3 Buckets Hosting KrustyLoader

**CIS CTI identified KrustyLoader hosted on multiple AWS S3 buckets delivering an encrypted Sliver implant that is decrypted in-memory, injected into explorer.exe, and deletes its on-disk binary; analysis recovered embedded AES keys, stage-2 S3 URLs, Sliver C2 domains, and numerous IOCs.** The campaign leverages abused legitimate cloud storage to evade filtering and has been delivered via exploitation of internet-facing appliances (Ivanti, SAP NetWeaver, ScreenConnect, TeamCity); CIS notified affected MS-ISAC members and reported buckets to AWS for takedown.