QRadar Top 3 Offenses Executive Summary for Clarusway's Training Network
Executive Summary
Incident Overview
On April 19, 2024, a security breach was detected in our AWS account, originating from a Russian IP address. The unauthorized access led to the deployment of multiple EC2 instances via the AWS API, indicating that an admin-level account was compromised. Concurrently, suspicious activity related to cryptocurrency mining was observed. Additionally, a Trojan was identified on an internal system, which likely facilitated SSL tunneling to exfiltrate personal data from the Experience Center server to a Chinese IP address.