Post

Step 1: How did they get access on the Safe{Wallet} dev's box? Answer: Social Engineering (isn't it always?)

Step 2: How did they get access to AWS? With code execution on the developer's workstation they were able to exfiltrate AWS keys and use them locally. Let's comment on the IP/VPN setup first.

If you have C2 on a developer's workstation you have two choices when it comes to creds. You can either use them FROM the compromised workstation, OR you can exfiltrate creds and use them remotely. Using them from the workstation has several advantages...