My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance.
The email states: We observed machines under your control participating in a DDoS attack targeting Google IPs.
The attack was a UDP amplification attack. In this attack, a UDP-based service is abused to attack others, wasting your bandwidth and computing resources.
I am fairly new to all of this stuff in addition to AWS and have no idea as to where to start. What should be the first steps for me to take to mitigate this?
After running the commands from @ximaera
Davids-MacBook-Pro:~ davidpham$ ntpdc -nc monlist *ip* *ip*: timed out, nothing received ***Request timed out Davids-MacBook-Pro:~ davidpham$ dig @ip +edns=0 +ignore com ANY <<>> DiG 9.10.6 <<>> @ip +edns=0 +ignore com ANY ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached Davids-MacBook-Pro:~ davidpham$
This was the output I received. Am i missing something?