Executive Summary
In cloud environments, attackers leverage legitimate AWS features to establish persistent footholds that can survive standard containment efforts. This intelligence highlights four primary methods observed in the wild: the creation of backdoored IAM users, modification of 'Assume Role' policies for cross-account access, injection of malicious code into Lambda functions, and the generation of federated user sessions using STS.
Technically, these attacks manifest through specific API calls like `iam:CreateUser`, `iam:UpdateAssumeRolePolicy`, and `lambda:CreateFunctionUrlConfig`. A critical risk involves federated sessions; because these are short-term credentials, disabling the originating IAM user's access keys does not immediately revoke the active session, allowing an attacker to remain active until the session naturally expires or is explicitly blocked via policy.
Failure to identify these mechanisms can lead to a false sense of security during incident recovery, allowing attackers to re-compromise the environment using hidden administrative backdoors. Organizations should focus on monitoring CloudTrail for unauthorized principal creation and changes to resource-based trust relationships.