Incident report: From CLI to console, chasing an attacker in AWS

An attacker used an exposed long-term AWS access key to access an environment via the CLI, discovered an IAM user, changed that user's console password to log into the AWS console, created two new IAM users with long-term access keys and administrator privileges, and requested an EC2 quota increase likely intended to support cryptocurrency mining; the activity was detected via CloudTrail-based detections and contained before major impact.