The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

An autonomous investigation system identified a multi-platform attack involving compromised credentials and data exfiltration across AWS and GitHub within minutes. The initial investigation started with simultaneous alerts related to unusual VPN access, anomalous API calls, and the use of offensive tooling in an AWS environment. Triage revealed that an IAM service account, svcautomation, was exhibiting behavior inconsistent with historical baselines, appearing from atypical source IPs and using malicious user agents like kali-amd64.
The investigation traced activity across multiple accounts, revealing that an actor utilized compromised credentials to pivot between different AWS accounts, involving operations like AssumeRole and SSM commands targeting production infrastructure. Further investigation of the data plane uncovered custom Python scripts staged in an S3 bucket, which were used by compromised instances to extract data from various systems, including SQL, PostgreSQL, and billing data.
The attack chain involved initial access via cloning private repositories from GitHub, pivoting using stolen AWS credentials, lateral movement to a production domain controller, staging exfiltration tools, and finally executing scripts to extract sensitive information. The system demonstrated efficiency by correlating these disparate signals across cloud logs and source code platforms simultaneously, enabling the discovery of the full attack chain rapidly.

* An alert triggered for unusual user access through a third-party VPN.
* API calls originated from an unusual country.
* AWS Management API calls were made by a known offensive tool.
* The actor was identified as the IAM service account svcautomation, created in 2018 for CI/CD pipelines.
* The user agent string contained kali-amd64.
* The source IP belonged to Zenlayer Inc, geolocated to Taiwan.
* Historical baseline showed svcautomation operated exclusively from three Amazon-owned IPs using TeamCity Server and aws-sdk-go user agents.
* Detection window activity involved the actor using aws-cli on Kali Linux and performing operations outside the baseline scope.
* Cross-account investigation identified two AWS actors named svcautomation in different accounts, one utilizing a different permanent access key.
* Activity included AssumeRole actions from Zenlayer IPs targeting production resources.
* Data plane events showed custom Python scripts uploaded to an S3 bucket from Zenlayer IPs.
* The scripts targeted extraction from Microsoft SQL Server, PostgreSQL, and billing systems.
* A GitHub audit log revealed a compromised token was used to clone 18 private repositories from the same IP range.

The narrative emphasizes the profound risk inherent in the convergence of identity, code, and infrastructure security. The efficacy of the investigation lies not just in collecting data but in recognizing how disparate artifacts—a compromised Git token, a VPN exit node, an IAM role, and S3 object events—form a coherent attack graph. The automation succeeded by treating these as interconnected nodes rather than isolated alerts, which mirrors the complexity faced by human analysts struggling with context switching across specialized tools.
The pattern detected suggests that attackers increasingly rely on exploiting inherent trust relationships within cloud environments (like CI/CD roles) and code repositories as the primary vectors for privilege escalation and lateral movement, effectively weaponizing benign operational artifacts. The shift from monitoring management plane events (CloudTrail) to data plane operations (S3 object access) is a critical indicator of modern adversarial focus; managing credentials is insufficient if the actual extraction phase remains invisible in high-level logs.
The implication for defense is that siloed security controls, even across major platforms like AWS and GitHub, create blind spots when an attacker bridges the gap between the code they commit (GitHub), the infrastructure they control (AWS IAM/SSM), and the execution environment where data resides (S3). The success of autonomous investigation highlights a systemic failure in connecting the 'who' (identity), the 'what' (code exposure), and the 'where' (data access) into a single, actionable timeline. The focus should shift from preventing individual breaches to ensuring seamless, cross-platform context correlation to detect orchestrated campaigns operating at machine speed.
Bridge Questions:
How robust are existing security models in linking identity governance across organizational boundaries with data plane interaction?
What specific controls could effectively prevent the staging of custom exfiltration tools (like Python scripts) within S3 buckets, regardless of initial credential compromise?
If autonomous systems demonstrate this level of multi-platform correlation, what is the evolving responsibility structure between automated triage and human verification in a high-speed threat landscape?