Permissive Execution Permissions were Granted to Lambda Function

Cyngular uncovered a cloud threat where permissive execution permissions were granted to a Lambda function in AWS. The change was initiated by arn:aws:sts::528757810539:assumed-role/MaliciousEC2Role using the action AddPermission20150331v2 on arn:aws:lambda:us-west-2:…:MaliciousLambdaFunc, granting external account 248189932415 the right to invoke it. On its own the event reads Medium — but correlated with a leaked GitHub key, an impossible-travel Okta login and a downstream S3 policy change, the squad rates the overall campaign Critical: an external actor establishing persistence to stage data exfiltration.

How the squad worked this — one brain, six agents· click any agent to see just its activity

→

Observer

Detected

AddPermission on a Lambda from a role that has never granted execution rights — a baseline break, not a routine change.

See Observer's activity →

→

Hunter

Enriched

Tied 2.54.178.107 to a residential IL ISP (Partner Communications) and matched the AssumeRole pattern to prior key-abuse TTPs.

See Hunter's activity →

→

Investigator

Correlated

Joined the GitHub key leak, Okta impossible-travel and the S3 policy change into one incident — assessed as persistence staging exfiltration.

See Investigator's activity →

→

Deceptor

Baited

Seeded decoy credentials into the exposed function so any further use pinpoints the attacker's tooling.

See Deceptor's activity →

→

Resolver

Contained

Staged role isolation, session revocation and an egress block on the source IP — queued for your one-click approval.

See Resolver's activity →

Reporter

Briefed

Drafted the CISO summary and mapped every step to MITRE ATT&CK for the evidence pack.

See Reporter's activity →

🍯Deceptor honeypot engaged at 16:00:36 — the attacker used decoy credentials and touched honey-db-02, which is what confirmed intent and drove the whole resolution forward.See how →