Tales from the cloud trenches: The Attacker doth persist too much, methinks

Description

A leaked AWS access key led to malicious activities over a 150-minute period, involving five distinct IP addresses. The attackers employed both common and innovative tactics, including creating 'persistence-as-a-service' infrastructure, manipulating AWS Identity Center, and disabling organization-level services. Notable techniques involved creating Lambda functions for dynamic IAM user creation, using Telegram for operations, disabling trusted access for AWS services, and exploiting AWS Identity Center for persistence. The attack encompassed initial access, discovery, persistence, credential access, and impact tactics, highlighting the need for enhanced cloud security measures and detection strategies.