MY AWS ACCOUNT GOT HACKED - HERE IS WHAT HAPPENED

Summary from the TLDR InfoSec newsletter

A cloud architect discovered that their personal AWS account was breached when they received a DKIM verification email. They then removed the attacker's access and found that the attacker had created four IAM accounts for backdoor access, launched a large EC2 instance (possibly for cryptomining), created an AWS Organization and a new account, and used Resource Explorer to search for additional access. The post walks the reader through the author's full process, from discovery to incident response to root cause analysis.