Once identified, the malware exfiltrates them to a VPN server ... re downloading from the internet, and deploy AWS Identity and Access Management (IAM) to manage permissions to the resources.

"Historically AWS Identity IAM keys are leaked and used for data theft ... He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations).