Product
S3
- First Reported
- Sep 17, 2026
- Latest Reported
- Sep 29, 2026
Reported Context (2)
- surfaced something the management plane couldn't: the attacker had staged custom exfiltration tools in an S3 bucket. Three Python scripts appeared in the Path field of PutObject events from Zenlayer IPs: Wiz Blue Agent Traces AWS and GitHub Data Exfiltration Attack
- History is still there though, which is a way to see 90 days of events, but through limited interface. S3 Public Block Access is not enabled at the account level, but is default enabled at the bucket level when AWS’s New Sign-Up Sandbox Limits Security Controls, Requiring an Upgrade for Full Protection
MITRE ATT&CK (7)
Vendors (3)
Products (22)
Tools (5)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.