TALES FROM THE CLOUD TRENCHES: THE ATTACKER DOTH PERSIST TOO MUCH, METHINKS

Summary from the TLDR InfoSec newsletter

Attackers leveraged a leaked AWS access key from an organization management account to establish multiple persistence mechanisms, including a "persistence-as-a-service" Lambda function triggered by API Gateway that creates new IAM users on demand. Previously unreported tactics included disabling trusted access for organization-level services, manipulating AWS Identity Center (SSO) to create backdoor users without MFA requirements, and operating from Telegram IP addresses. The attackers implemented comprehensive persistence strategies to survive credential revocation, demonstrating sophisticated knowledge of AWS services and security mechanisms.