Amazon AWS Faces Ongoing Cryptomining Campaign Using Hacked Accounts

Amazon’s AWS GuardDuty security team has identified a persistent cryptomining campaign that began on November 2nd. The attackers targeted AWS’s Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) by utilizing compromised Identity and Access Management (IAM) credentials. They employed a Docker Hub image named yenik65958/secret, which was created on October 29 and included an SBRMiner-MULTI cryptominer.

The attackers initiated cryptomining operations within 10 minutes of gaining access, following reconnaissance of EC2 service quotas and IAM permissions. They configured tasks with significant computational resources, including 16,384 CPU units and 32GB of memory, and set up auto-scaling groups capable of deploying up to 999 instances.

One notable technique used was the modification of instance attributes to disable API termination, which hindered incident responders from shutting down the mining operations. This setting forced responders to disable protections explicitly, thereby delaying their response and maximizing the attackers’ profits.

Amazon has alerted affected customers to rotate their compromised IAM credentials and removed the malicious Docker Hub image. However, the company warns that similar images could be deployed under different names in the future, indicating a potential ongoing risk.

Understanding the Implications

This incident underscores the importance of securing IAM credentials, as the attackers did not exploit a vulnerability but rather used valid credentials. Organizations must be vigilant in monitoring their IAM configurations and ensuring that access controls are strictly enforced.

Everyday users and organizations should regularly audit their AWS accounts for any unauthorized access or unusual activity. Implementing multi-factor authentication (MFA) can also provide an additional layer of security against credential theft.

As the threat landscape evolves, organizations should stay informed about similar cryptomining campaigns and consider employing automated monitoring tools to detect unauthorized resource usage. This proactive approach can help mitigate the risks associated with compromised credentials and resource exhaustion.