AWS CloudTrail Forensics: Defending Against Cross-Account Attacks and Crypto Mining
AWS released a comprehensive incident response guide demonstrating two critical attack scenarios affecting cloud environments in 2025. The first scenario involves a cross-account S3 data deletion attack where threat actors assumed roles from trusted accounts, performed reconnaissance through ListBuckets operations, and executed scripted deletions of financial reports, PII databases, and production backups within a 13-second window. The second scenario showcases cryptocurrency mining operations deployed through AWS CloudFormation, where attackers leveraged console credentials without MFA to create the 'CRYPTO' stack containing EC2 instances for mining operations. Both incidents highlight the sophistication of modern cloud-native attacks that exploit legitimate AWS services and cross-account trust relationships. These attack patterns are increasingly relevant as organizations accelerate cloud adoption while struggling with proper access controls, zero trust implementation, and multi-cloud visibility. The incidents underscore the critical need for enhanced CloudTrail monitoring, cross-account access reviews, and comprehensive egress security policies.
Kill Chain
