Data Exfiltration to S3 Bucket

Attackers often target valuable data to steal through exfiltration, such as sensitive customer data, financial information, or trade secrets. Data can be exfiltrated by employees with authorized access to critical assets, or by attackers who gain unauthorized access to critical assets through malware or an exploit. S3 buckets require user information to set up, so experienced attackers might choose to move data to a server that requires less exposure. However, attackers can hide large data uploads by sending the data to a web service, such as Amazon S3, that is frequently accessed by internal devices and approved by firewall policies.