←back to thread

391 points kinj28 | 1 comments | | HN request time: 0s | source

Could there be any link between the two events?

Here is what happened:

Some 600 instances were spawned within 3 hours before AWS flagged it off and sent us a health event. There were numerous domains verified and we could see SES quota increase request was made.

We are still investigating the vulnerability at our end. our initial suspect list has 2 suspects. api key or console access where MFA wasn’t enabled.

Show context
ThreatSystems ◴[] No.45657872[source]
Cloudtrail events should be able to demonstrate WHAT created the EC2s. Off the top of my head I think it's the runinstance event.
replies(3): >>45658322 #>>45659025 #>>45660389 #
1. sylens ◴[] No.45658322[source]
RunInstances