01 02 03 04 05 06 07
Phase 5 of 5 · AWS Data Theft via OrgAdmin

Phase 5 · Exfiltration

ACTIVE AWS SESSION OrganizationAccountAdmin arn:aws:sts::448291:assumed-role/OrganizationAccountAdmin/red-team-pivot ALL ACCESS
AWS Resources · S3 · RDS · Secrets Manager
Idle
0 MB / 2.4 GB
0 / 7 resources stolen
Attacker S3 Bucket s3://red-team-loot-9af2
Click any AWS resource to siphon it with the OrgAdmin session, or run a full smash-and-grab.