The Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
summary
A multi‑cloud intrusion steals about $107M over seven months, culminating in an $80M heist; attackers social‑engineer the help desk to reset an approver’s Entra MFA, extract a developer’s GitHub PAT from a corporate password manager, use a malicious GitHub Actions PR to create an IAM secops user, then run AWS SSM commands on the hot‑wallet EC2 to execute the legit signing script and route funds through BitGo and mixers. Detection gaps across services enable stealthy, automated laundering.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 4:34Discovery of the $18 million theft
- 7:24Help desk compromise revealed
- 13:24Expanding scope to $107 million
- 15:51AWS SSM compromise investigation
- 18:00GitHub secrets and compromised PAT
- 21:50Pull request attack vector
- 24:15Password manager compromise
- 28:49Password reset timeline analysis
- 36:11Reconnaissance via email search
- 39:38Full attack timeline reconstruction
- 41:03Key takeaways and lessons learned
- 42:49Q&A session
related talks
16mLessons from the SOC: Analyzing and remediating cloud attack paths
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
35mHow I Handled One of the Biggest Banking Fraud Incidents of 2020
27mAnatomy of an AWS Account Cryptojack
50mInsights into New Supply Chain and Cloud-Identity Attacks
43mHacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
51mModern Bank Heists
40mEscalation from Heist to Hostage: Modern Bank Heists 4.0