Skip to content
Threat Feed
Subscribe

Product

Elastic Compute Cloud (EC2)

4 briefs RSS
medium advisory

Abuse of AWS EC2 Export APIs for Data Exfiltration

Adversaries with compromised AWS credentials can exploit EC2 export APIs to copy entire virtual machine states or images to external storage for data exfiltration.

Elastic Compute Cloud +1 cloud exfiltration collection aws
1r 2t updated
medium advisory

Suspicious AWS EC2 Key Pair Import Activity

The import of SSH key pairs into AWS EC2, as detected by CloudTrail logs, may indicate unauthorized access attempts, persistence establishment, or privilege escalation by an attacker.

Elastic Compute Cloud aws cloudtrail ec2 keypair initial-access persistence privilege-escalation
2r 1t
medium advisory

AWS EC2 Security Group Configuration Change Detection

Detection of unauthorized changes to AWS EC2 Security Group configurations, potentially leading to persistence, data exfiltration, or lateral movement within the AWS environment.

Elastic Compute Cloud cloud aws security-group persistence
3r 4t
high advisory

AWS VPC Flow Logs Deletion for Defense Evasion

An adversary may delete VPC Flow Logs in AWS EC2 by calling the DeleteFlowLogs API to evade detection and hinder forensic investigations.

Elastic Compute Cloud cloud aws defense-evasion vpc flow-logs
2r 1t