Ticket summary
On 21 March 2026 FastCart opened IR-2026-0321-021 after GuardDuty raised a HIGH-severity Execution:Lambda/MaliciousIPCaller finding: fastcart-order-webhook made an outbound connection to known command-and-control infrastructure. No data loss was confirmed when the ticket opened. You are the investigating SOC analyst.
FastCart's checkout flow at shop.fastcart.io uses the internal Lambda function fastcart-order-webhook, exposed through an API Gateway REST API, to process asynchronous order-confirmation and refund callbacks from its payment provider.
Your job is to determine whether the webhook handler was exploited, whether code execution exposed and used the function's fastcart-webhook-exec-role credentials, which AWS resources that role could reach, and whether the attacker changed the function code to persist.
The ticket includes CloudTrail, Lambda CloudWatch Logs, API Gateway access logs, and the execution-role policy. Correlate request ID agw-mal-7f31 and the surrounding timestamps before declaring impact. Successful reads prove access; they do not by themselves prove that data left AWS.