This attack involved two principal types working in tandem. First, the 'apache' user on the EC2 instance was used to execute malicious commands through the php-fpm process, indicating web application compromise. This service account should never be executing bash commands, accessing /etc/shadow, or creating SUID binaries. Second, the 'us-app3-west-ro' IAM role associated with the EC2 instance was exploited to access S3 data. The role was designed for legitimate application use but was abused after credential theft. The EC2 instance (i-056e476a24de044d2) was relatively new, created just 3 days before the attack on 2025-05-22, suggesting this may have been a purpose-built vulnerable system or one that was targeted quickly after deployment before proper security hardening could be implemented.

The attack exhibited a clear location shift pattern indicative of credential theft and external use. Initially, all activity originated from the EC2 instance's own IP (54.176.66.94) in AWS infrastructure (AS16509, San Jose, US). This represented the web application compromise phase. The critical anomaly appeared when the same IAM role credentials were subsequently used from Manila, Philippines through a NordVPN connection (AS136787, IP 212.97.71.25). This represents impossible travel that cannot be explained by legitimate use patterns. Behavioral analysis showed this location had only been associated with this principal in 3 out of 181 historical observations (1.66%), making it highly suspicious. The use of a commercial VPN service (NordVPN/TEFINCOM S.A.) for accessing cloud resources strongly indicates deliberate attempts to mask the attacker's true location and evade detection mechanisms based on geographic anomalies.

The attack progressed through a series of coordinated actions that align perfectly with the cyber kill chain: 1) Web application exploitation allowed command execution through php-fpm, leading to connection with C2 infrastructure (whatsqpp.ru) and system reconnaissance; 2) Credential harvesting via accessing /etc/shadow and storing password hashes in hidden location (/var/tmp/.ssh/conf/keys); 3) Privilege escalation attempts through creation of a SUID binary (/var/tmp/.sshd) designed to provide root access; 4) AWS credential theft (inferred from subsequent activity); and 5) Data access/exfiltration targeting specific financial documents in S3 ('exaforce_earnings.text.rtf' and 'exaforce_business_financial.txt.rtf'). The systematically increasing impact of these actions - from system reconnaissance to targeted data access - demonstrates a sophisticated threat actor with specific objectives rather than opportunistic exploitation.

Multiple behavioral anomalies confirm the malicious nature of this attack chain: 1) Process ancestry violations where php-fpm spawned bash processes - a classic indicator of web application compromise; 2) Creation of hidden files and directories with suspicious names (.sshd, .ssh/conf/keys) to evade detection; 3) Use of SUID binary creation - a rarely legitimate operation typically associated with privilege escalation attempts; 4) Access to sensitive credential files like /etc/shadow which should never be accessed by web server processes; 5) Network location shifts from AWS infrastructure to VPN services; 6) Targeted access to financial documents suggesting data theft rather than random exploration. The sequence of activities perfectly aligns with established MITRE ATT&CK patterns for web application compromise followed by privilege escalation, credential theft, and data exfiltration. The attacker's operational security measures (hidden files, error output redirection, VPN usage) demonstrate sophistication and deliberate attempts to evade detection.

This attack chain warrants Critical severity (5) with P0 priority due to: 1) Confirmed malicious activity with multiple high-confidence detections across different security tools; 2) Successful compromise of cloud credentials leading to data access; 3) Targeting of sensitive financial documents; 4) Sophistication demonstrating a determined threat actor rather than automated scanning; and 5) The recommendation is clearly 'NeedsInvestigation' given the overwhelming evidence of coordinated malicious activity. The EC2 instance (i-056e476a24de044d2) and associated IAM role (us-app3-west-ro) should be immediately isolated and revoked respectively to prevent further unauthorized access.