The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

This case study describes an automated investigation (the Blue Agent) into a multi-stage attack: a compromised GitHub token was used from a VPN IP to clone private repos (likely exposing hardcoded AWS keys), those keys were used to access multiple AWS accounts from a Zenlayer VPN IP and Kali user-agent, the attacker executed SSM SendCommand on a production domain controller, staged custom Python exfiltration scripts in S3, and extracted sensitive SQL/Postgres and billing data—demonstrating coordinated credential theft, lateral movement, and active data exfiltration.