A cloud engineer has deployed a virtual storage appliance into a public cloud environment. The storage appliance has a NAT to a public IP address. An administrator later notices there are some strange

Default passwords are a well-known and widely exploited vulnerability - attackers routinely conduct automated scans for internet-facing appliances and attempt login using published manufacturer default credentials. Once authenticated, an attacker can upload malicious files, exfiltrate data, or enlist the device in botnet activity, all of which produce the strange files and large traffic spike observed. The presence of a public NAT IP makes the appliance directly reachable, making default credentials the most likely attack vector.

An expired certificate disrupts trusted TLS connections but does not grant an attacker authenticated access sufficient to write files or generate anomalous outbound traffic.

While the absence of a firewall increases the attack surface, the specific symptoms of written files and traffic spikes most directly indicate a successful credential-based compromise rather than a purely network-level exploit.

Encryption and file hashing are data-at-rest protection features and would not cause unexplained file creation or a spike in outbound network traffic.