S3 data exfiltration (Incident)
ID: 32da0140-8bc1-5dbb-9d99-30ac29969f40
STIX ID: report--32da0140-8bc1-5dbb-9d99-30ac29969f40
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2024-01-19
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
Datadog observed an attacker using a compromised AWS IAM access key to gain access, create new admin users (likely automated), enumerate cloud identities and VMs, attempt EC2 Instance Connect to access instances, download data from S3 buckets, and try to spin up new VMs — a cloud compromise involving data exfiltration and persistence attempts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.