Product
Threat actors with compromised AWS credentials may use RDS restoration operations to duplicate sensitive database environments, facilitating unauthorized data access, staging, and exfiltration while bypassing production monitoring controls.