Wiz Blue Agent Traces AWS and GitHub Data Exfiltration Attack
Summary
Wiz describes how its Blue Agent investigated suspicious AWS activity, linked it to a compromised GitHub token and stolen credentials, and traced activity across accounts to custom data-exfiltration tools.
Key points
- An alert on an AWS CI/CD service account prompted an investigation after activity came from an unusual VPN IP and used a Kali Linux user agent.
- The activity diverged from the account’s 30-day baseline, including unusual role assumptions and Systems Manager commands.
- The agent found related activity in a second AWS account, including commands targeting a production domain controller.
- S3 events showed custom scripts for extracting SQL Server, PostgreSQL, and billing data; compromised instances retrieved and executed the tools.
- GitHub audit logs showed a compromised token cloning 18 private repositories from the same IP hours earlier; the article says stolen AWS credentials may have enabled the AWS access.
- Wiz says the investigation across AWS CloudTrail, S3 data events, and GitHub audit logs took minutes.
Article Details
- Defense Focus
- Investigate compromised service-account credentials and trace cross-platform source-code theft, cloud command execution, and data exfiltration.
- Detection Methods
- Triage simultaneous alerts for third-party VPN access, API calls from an unusual country, and AWS management API calls associated with offensive tooling.
- Compare 30 days of service-account activity with the detection window across source IPs, user agents, ASO, operations, and geography.
- Query tenant-wide AWS activity for actors sharing the suspicious hosting-provider ASO and correlate identities, access keys, source IPs, and timelines across accounts.
- Inspect S3 PutObject events and object paths for staged exfiltration scripts, then correlate uploads with retrieval and execution by compromised instances.
- Pivot from the suspicious source IP into GitHub audit logs to identify compromised-token activity and private-repository cloning.
- Data Sources
- Threat metadata, including actor identity, triggering event names, and source IPs
- AWS CloudTrail events
- Thirty days of historical service-account activity
- S3 data events, including PutObject paths
- GitHub audit logs
- Source-IP reputation, hosting-provider attribution, and geolocation
- Rule Types
- Unusual User Access Through Third-Party VPN
- API Calls From Unusual Country
- AWS Management API Calls by a Known Offensive Tool
- Defensive Actions
- Validate whether VPN activity is consistent with the identity's purpose rather than treating VPN use alone as malicious.
- Extend investigations across accounts and platforms using shared suspicious IPs and identity evidence.
- Inspect data-plane activity alongside management-plane events to identify staged tools and data access.
- Provide analysts with the verdict and complete investigation flow for human review of high-priority cases.
MITRE ATT&CK
T1059.006 · PythonCompromised EC2 instances executed custom Python scripts for extracting SQL, PostgreSQL, and billing data.T1078.004 · Cloud AccountsThe attacker authenticated to AWS using compromised permanent access keys for svc_automation in two accounts.T1090.002 · External ProxyThe attacker operated through Zenlayer VPN IPs while accessing AWS and cloning private GitHub repositories.T1105 · Ingress Tool TransferThe attacker staged custom exfiltration scripts in S3, and compromised EC2 instances retrieved them using curl.T1213.003 · Code RepositoriesA compromised GitHub token was used to clone 18 private repositories before the AWS activity.T1552.001 · Credentials In FilesThe article suggests that the attacker may have obtained svc_automation access keys from hardcoded credentials in cloned repository contents; this credential origin is not established conclusively.T1651 · Cloud Administration CommandThe attacker used SSM SendCommand against a production EC2 instance identified in the article as a Windows domain controller.
Vendors
WizThe Blue Agent is Wiz's autonomous SOC investigator. When a threat fires, the Blue Agent begins its investigation: gathering evidence, comparing activity against historical baselines, checking IP reputation, validatingZenlayer IncThe source IP belonged to Zenlayer Inc, a hosting provider commonly associated with VPN exit nodes, geolocated to Taiwan.
Products
AWSThe Blue Agent started by investigating three detection rules fired simultaneously against a single actor in an AWS account:AWS CloudTrailwas completed in minutes. A human analyst following the same investigation thread across AWS CloudTrail, S3 data events, and GitHub audit logs would spend hours context switching between platforms, writingBlue AgentThe Blue Agent is Wiz's autonomous SOC investigator. When a threat fires, the Blue Agent begins its investigation: gathering evidence, comparing activity against historical baselines, checking IP reputation, validatingEC210:06 UTC: SSM SendCommand targeting a production EC2 instanceGitHubPhase 4: GitHub - Finding the Initial Access PointKali LinuxThe user agent string contained kali-amd64: Kali Linux, a distribution commonly used by malicious actors.Microsoft SQL ServerThe filenames themselves told a story. These were customized scripts for extracting data from Microsoft SQL Server, PostgreSQL, and billing systems. The attacker uploaded them from Kali Linux, then the compromised EC2PostgreSQLthemselves told a story. These were customized scripts for extracting data from Microsoft SQL Server, PostgreSQL, and billing systems. The attacker uploaded them from Kali Linux, then the compromised EC2 instancesS3surfaced something the management plane couldn't: the attacker had staged custom exfiltration tools in an S3 bucket. Three Python scripts appeared in the Path field of PutObject events from Zenlayer IPs:TeamCity ServerFor the past month, svc_automation had operated exclusively from three Amazon-owned IPs, using TeamCity Server and aws-sdk-go user agents, performing routine CI/CD operations like GetSessionToken, AssumeRole to
Tools
aws-cliThe detection window activity showed something different. The actor appeared from unusual IPs, using aws-cli on Kali Linux, and attempted operations far outside its normal scope, including unusual AssumeRole andbilling_export2.py/ops-tools/billing_export2.pycurlattacker uploaded them from Kali Linux, then the compromised EC2 instances retrieved and executed them via curl from Amazon-owned IPs, showcasing the SSM commands in action.mssql_table_export.py/ops-tools/mssql_table_export.pypg_table_export.py/ops-tools/pg_table_export.py