SCARLETEEL: AWS Fargate Breach to Cloud Crypto-Mining
An internet-reachable JupyterLab notebook on AWS Fargate was exploited for code execution. The operator stole the task role credentials from the container metadata endpoint, replayed them to harvest Secrets Manager and SSM secrets, minted a new access key for persistence, read the Terraform state and a customer-ledger export, and finished by launching compute-optimized instances to mine cryptocurrency. Work the CloudTrail audit trail alongside the SIEM proxy, DNS, and firewall egress records to reconstruct the chain.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establish where the intrusion began
15The earliest malicious activity did not appear in the cloud audit trail at all. Something happened inside a workload before any AWS API call. Determine where it started.
Classify how the cloud credentials were stolen
15Once inside the container, the operator obtained AWS credentials without phishing, brute force, or a leaked key. Map the technique to its MITRE ATT&CK sub-technique.
Identify the stolen workload identity
20The credentials read inside the container belong to a specific AWS role. When that role then appears from outside the network, you have your anomaly. Name the role.
Find the secret that was retrieved in plaintext
20With the stolen role, the operator went straight for secrets. One stored secret was retrieved decrypted. Identify it by its secret name.
Pin the persistence the operator established
20Temporary credentials expire. The operator created something durable so access would survive. Identify the long-term credential that was minted.
Trace the data exfiltration egress
20Sensitive data left the environment over the network. Identify the external address the customer-data archive was pushed to.
Classify the final impact technique
15The intrusion ended by spending the victim's money on attacker compute. Map that action to its MITRE ATT&CK technique.
7 tasks · 125 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Firewall Console
Network traffic analysis
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allEvilProxy AiTM: Indeed Redirect to M365 Cookie Theft
An executive at a logistics firm clicks a job-themed phishing link that abuses a recruiting platform's open redirect to reach an EvilProxy adversary-in-the-middle page. The page reverse-proxies the real Microsoft 365 sign-in, so the victim completes MFA against the attacker, who captures and replays the post-MFA session cookie. Work the email, web-proxy, DNS, Entra sign-in, and perimeter records to reconstruct the redirect chain, the relay infrastructure, and the MFA bypass.
Finding Gozi: An Italian Malspam Infection
An accounts clerk at an Italian textile firm clicked an overdue-invoice link, downloaded a ZIP, and opened an Internet shortcut that reached out over SMB to pull a second-stage loader. PowerShell and rundll32 ran the Gozi banking trojan, and the workstation began beaconing to a rotating list of bare IP-literal hosts over plain HTTP. Trace the chain from a link-based lure through an SMB stage-2 fetch to the single command-and-control endpoint the trojan settled on, where it also shipped the stolen data.
Lazarus: ManageEngine RCE to QuiteRAT Espionage
An internet-facing ManageEngine ServiceDesk Plus appliance at Caldermoor Networks, a regional network and internet service provider, falls to the unauthenticated SAML RCE (CVE-2022-47966). Code runs as the appliance service account, which curls down a QuiteRAT first-stage implant, profiles the host and domain, installs itself as an auto-start Windows service, and beacons to a single HTTPS C2 that carries control and stolen data alike before pulling a CollectionRAT second stage. Work the ManageEngine web logs, the endpoint process tree, and the perimeter egress to reconstruct the intrusion. North-Korea-nexus actor.