Chasing ghosts through serverless forensics in Lambda and Azure Functions
Andrea Fortuna
A cryptominer called Denonia ran quietly inside AWS Lambda for months, disguised as legitimate function invocations, before anyone noticed the CPU bill looked wrong. By the time a Cado Security team went looking, the execution environment that had run the miner no longer existed. It had been...