2 ms·
this is helpful. i will look for the logs. Also some more observations below: 1) some 20 organisations were created within our Root all with email id with sam
by jinen83 1y ago
this is helpful. i will look for the logs.
Also some more observations below:
1) some 20 organisations were created within our Root all with email id with same domain (co.jp)
2) attacker had created multiple fargate templates
3) they created resources in 16-17 AWS regions
4) they requested to raise SES,WS Fargate Resource Rate Quota Change was requested, sage maker Notebook maintenance - we have no need of using these instances (recd an email from aws for all of this)
5) in some of the emails i started seeing a new name added (random name @outlook.com)
- ThreatSystems 1y agoIt does sound like you've been compromised by an outfit that has got automation to run these types of activities across compromised accounts. A Reddit post[0] from 3 years ago seems to indicate similar activities. Do what you can to triage and see what's happened. But I would strongly recommend getting a professional outfit in ASAP to remediate (if you have insurance notify them of the incident as well - as often they'll be able to offer services to support in remediating), as well as, notify AWS that an incident has occurred. [0] https://www.reddit.com/r/aws/comments/119admy/300k_bill_after_aws_account_hacked/ https://www.reddit.com/r/aws/comments/119admy/300k_bill_afte...