AWS CLI

Reported Context (2)

Furthermore, the AWS CLI was also observed being used for this activity, which was also unusual for the user. Compromised AWS AI Gateway Used for Cryptomining, Darktrace Reports
User-agent strings in these calls form two groups (see Indicators): one linked to a Fedora/Qubes AWS CLI build from the first IP, and another associated with an Ubuntu 26 AWS CLI build that accounts for most of the Shai Hulud-Linked Intrusion Escalated From Jenkins Credentials to AWS Redshift Data Theft

Malware (4)

People (5)

Threat Actors (1)

MITRE ATT&CK (15)

Vendors (3)

Products (15)

Tools (3)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.