DAT Solutions Internal

Back
May 6, 2026 1:43 PM PDT

Malware on CSB EC2 instances

Updates

  • May 28, 2026 2:31 PM PDT

    A potential compromise of an CSB ftp EC2 instances was detected The incident was contained and resolved through containment of the affected FTP/EC2 instances, removal of anonymous FTP access, deletion of malicious files and test users, restart of the FTP service, and forensic data collection, followed by security hardening (revoking root access, rotating passwords, disabling unused accounts, centralizing evidence). The FTP server was brought back online with the AWS Global Accelerator reenabled and customer communications prepared

    Resolved
  • May 6, 2026 1:43 PM PDT (3 weeks, 1 day, and 47 minutes earlier)

    A potential compromise of an CSB ftp EC2 instances was detected Mitigation actions included containing the affected FTP/EC2 instances, removing anonymous FTP access, deleting malicious files and the test1 user, restarting the FTP service, and collecting forensic data (EBS snapshot, CloudTrail/Datadog/CrowdStrike logs) to prevent further impact. Additionally, the team hardened the environment (revoking root access, rotating passwords, disabling unused accounts, centralizing evidence in S3, and preparing customer communications) while continuing investigation to determine restoration readiness.

    Monitoring