AWS Network Exploitation and Ransomware Detonation (Campaign)
ID: a976aa85-dfaf-55de-9cce-28a0c2ee0f9c
STIX ID: report--a976aa85-dfaf-55de-9cce-28a0c2ee0f9c
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2025-07-08
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
A misconfigured, internet-exposed SonicWall SMA 500v EC2 instance was compromised; attackers used Vultr VPS endpoints to scan and pivot between EC2 instances via RDP, exfiltrated over 700 GB (including large SMB transfers) to a GTHost VPS using uncommon ports, and deployed ransomware within the affected VPC.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.