AWSDoor: New Persistence Technique Attackers Use to Hide in AWS Cloud Environments

The article discusses a new persistence technique called AWSDoor, which attackers use to maintain access in Amazon Web Services (AWS) environments. AWSDoor automates the modification of AWS Identity and Access Management (IAM) settings, allowing attackers to create AccessKeys and alter role trust policies without detection. It can also manipulate AWS Lambda functions and EC2 instances to establish hidden backdoors.

To defend against such techniques, organizations are advised to monitor AWS logs, set alerts for unusual activities, and conduct regular audits of IAM configurations. The article emphasizes the importance of continuous monitoring and least-privilege practices to mitigate risks.