### Overview
After executing unauthorized commands, the threat actor has likely focused on establishing persistence in the compromised environment by exploiting IAM roles.

### Key Findings:
- **IAM Role Abuse**: The adversary exploited misconfigured IAM roles to gain persistent access.
- **Credential Access**: Temporary credentials were likely extracted to ensure continued access.

### Implications:
The establishment of persistence indicates the adversary's intent to maintain long-term access and potentially move laterally within the cloud environment.