THE CURIOUS CASE OF DANGERDEV@PROTONMAIL.ME

Summary from the TLDR InfoSec newsletter

This post provides a deep dive into an incident that Invictus responded to. The threat actor was unique in that it utilized a new method of persistence in which it set up a cross-account role. The post divides the threat actor's activities into three primary phases of attack and delves into the motives and impact of each one.