🇵🇱
Budyn
2026-11-13 19:17:54
UTC ·
(11 hours ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_7 | Action: AWS API Call | Token ID: 4dvmm7wgh55qaj86jjj1vqe1z | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3 ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_7 | Action: AWS API Call | Token ID: 4dvmm7wgh55qaj86jjj1vqe1z | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/ins...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-13 17:06:45
UTC ·
(13 hours ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_1 | Action: AWS API Call | Token ID: jjbmqxvagp71pskep78twdp5w | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3 ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_1 | Action: AWS API Call | Token ID: jjbmqxvagp71pskep78twdp5w | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/ins...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-13 10:37:30
UTC ·
(20 hours ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_11 | Action: AWS API Call | Token ID: 7lggvodiip8vznhits5cv0986 | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python# ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_11 | Action: AWS API Call | Token ID: 7lggvodiip8vznhits5cv0986 | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/ins...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-13 07:26:36
UTC ·
(23 hours ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_5 | Action: AWS API Call | Token ID: oivim5afqu4p15ffms5ex4pv4 | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3 ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_5 | Action: AWS API Call | Token ID: oivim5afqu4p15ffms5ex4pv4 | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/ins...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-13 04:13:21
UTC ·
(1 day ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_8 | Action: AWS API Call | Token ID: 95b23kxelv1qyzc6evkizbyhn | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3 ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_8 | Action: AWS API Call | Token ID: 95b23kxelv1qyzc6evkizbyhn | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/ins...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-13 02:10:09
UTC ·
(1 day ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_10 | Action: AWS API Call | Token ID: 53hmvky4jw5pgwl8xxid8p06l | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python# ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_10 | Action: AWS API Call | Token ID: 53hmvky4jw5pgwl8xxid8p06l | Client tool: aws-cli/2.40.2 md/awscrt#0.38.1 ua/2.1 os/linux#6.8.0-87-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/ins...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-12 22:22:07
UTC ·
(1 day ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_10 | Action: AWS API Call | Token ID: 53hmvky4jw5pgwl8xxid8p06l | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_10 | Action: AWS API Call | Token ID: 53hmvky4jw5pgwl8xxid8p06l | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-12 20:02:18
UTC ·
(1 day ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_11 | Action: AWS API Call | Token ID: 7lggvodiip8vznhits5cv0986 | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_11 | Action: AWS API Call | Token ID: 7lggvodiip8vznhits5cv0986 | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-12 11:02:26
UTC ·
(1 day ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_2 | Action: AWS API Call | Token ID: tu8jkpvo92f821qykacxbbvok | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python# ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_2 | Action: AWS API Call | Token ID: tu8jkpvo92f821qykacxbbvok | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
throny
2026-11-12 07:02:10
UTC ·
(1 day ago)
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-12 06:44 UTC, API call GetAccount, client aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl ...
show more
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-12 06:44 UTC, API call GetAccount, client aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-11-12 05:43:02
UTC ·
(2 days ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_4 | Action: AWS API Call | Token ID: 3a228y9iwzbmqpgsnaaic99y3 | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python# ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_4 | Action: AWS API Call | Token ID: 3a228y9iwzbmqpgsnaaic99y3 | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-12 03:27:50
UTC ·
(2 days ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_8 | Action: AWS API Call | Token ID: 95b23kxelv1qyzc6evkizbyhn | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python# ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_8 | Action: AWS API Call | Token ID: 95b23kxelv1qyzc6evkizbyhn | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
throny
2026-11-12 00:20:42
UTC ·
(2 days ago)
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-12 00:10 UTC, API call GetAccount, client aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl ...
show more
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-12 00:10 UTC, API call GetAccount, client aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-11-11 12:53:45
UTC ·
(2 days ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_3 | Action: AWS API Call | Token ID: 4tpvosl7k2etr0dcza06lsb9g | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python# ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_3 | Action: AWS API Call | Token ID: 4tpvosl7k2etr0dcza06lsb9g | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-11 10:22:49
UTC ·
(2 days ago)
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_12 | Action: AWS API Call | Token ID: akf9s74n5eldbzbpzbzf5lt45 | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python ...
show more
[Budyn SOC Canary] | Event: AWS Key Compromised! | Evidence: | Memo: AWS_Token_12 | Action: AWS API Call | Token ID: akf9s74n5eldbzbpzbzf5lt45 | Client tool: aws-cli/2.39.3 md/awscrt#0.38.0 ua/2.1 os/linux#5.15.0-46-generic md/arch#x86_64 lang/python#3.14.8 md/pyimpl#CPython m/g,E,Z,b cfg/retry-mode#standard md/in...
show less
Hacking
Bad Web Bot
Web App Attack