TGViewer
CloudSec Wine CloudSec Wine @cloud_sec · 2.27K subscribers
Post #341 725
🔶 Incident report: From CLI to console, chasing an attacker in AWS

How the Expel team detected and stopped an unauthorized access in one AWS environment.

https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws

#aws
Expel Incident report: From CLI to console, chasing an attacker in AWS Our SOC detected and stopped unauthorized access in one of our customer’s AWS environments. Here’s how we spotted it, the steps we took to understand what they did, lessons learned and key takeaways.
Open in Telegram All posts from @cloud_sec
More from @cloud_sec
  1. Oct 13, 2026👩‍💻 Azure's Weakest Link - Five Full Cross-Tenant Compromises Five critical Azure cross-…
  2. Oct 12, 2026🤖 The AI SDLC transformation playbook Atlassian's shared their own version of an AI SDLC…
  3. Oct 9, 2026⚠️ Discovering and exploiting a remote code execution vulnerability in OpenCode Datadog Se…
  4. Oct 8, 2026🤖 How DigitalOcean Manages Credentials for Autonomous Agents DigitalOcean Managed Agents…
  5. Oct 7, 2026👩‍💻 Storm-3168: Agentic-driven cloud attacks using compromised service principals Storm-…
  6. Oct 6, 2026🤖 Securing the software factory at machine speed GitLab's CISO argues that agentic AI dev…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →