AWS Cryptomining Attacks Highlight Need for Cloud Permissions Firewall
- Securityish
- Threats & Incidents
Quick Summary
A recent cryptomining campaign targeted Amazon Web Services (AWS) by exploiting compromised credentials to execute privileged API calls. Attackers used commands like ec2:CreateLaunchTemplate and ecs:RegisterTaskDefinition to provision resources, leading to potential financial losses. The Sonrai Cloud Permissions Firewall mitigates these risks by enforcing strict permission controls, blocking unauthorized API calls and preventing resource provisioning.
The Securityish Brief
The recent cryptomining campaign against Amazon Web Services (AWS) illustrates significant vulnerabilities in cloud security. Attackers leveraged compromised credentials to execute privileged API calls, such as ec2:CreateLaunchTemplate and ecs:RegisterTaskDefinition, allowing them to provision compute resources for cryptomining. This attack highlights the inadequacies of traditional detection tools, which only identify anomalies after they occur.
The Sonrai Cloud Permissions Firewall addresses these vulnerabilities by enforcing a ‘Global Default Deny’ policy on privileged permissions. Research indicates that 92% of identities granted these permissions never utilize them, allowing organizations to block unnecessary access proactively. By denying the specific API calls required for attacks, the Firewall prevents cryptomining from being executed.
During the attack, adversaries also attempted to create backdoor accounts using iam:CreateUser and maintain access through publicly invocable Lambda Functions. The Firewall’s mechanism of blocking toxic combinations of permissions ensures that only necessary identities have access to sensitive actions, effectively containing potential threats.
Independent testing has shown that the Cloud Permissions Firewall achieved a 100% prevention rate against various attack paths, demonstrating its effectiveness in securing AWS environments. By denying the execution of privileged API calls, organizations can prevent attackers from provisioning resources and incurring financial damage.
This incident serves as a reminder that identity is the new perimeter in cybersecurity. Organizations must shift from reactive detection to proactive prevention by managing privileged permissions effectively. The Sonrai Cloud Permissions Firewall offers a solution to stop attacks at the first API call, enhancing overall security posture.
Key Takeaways
- Review and limit privileged permissions for cloud identities to reduce attack vectors.
- Implement a Cloud Permissions Firewall to proactively block unauthorized API calls.
- Monitor for unusual activity in cloud environments, especially in obscure regions or services.
- Educate teams on recognizing and responding to notifications of compromised credentials.
- Regularly audit identity usage to ensure that permissions align with actual needs.
Key Terms & Concepts
- Cloud Permissions Firewall: In this article, the Cloud Permissions Firewall refers to a security tool that manages and restricts access to privileged permissions in cloud environments.
- Privileged API Calls: Privileged API calls are commands that grant elevated access to cloud resources, which can be exploited if credentials are compromised.
- Cryptomining: Cryptomining is the process of using computing resources to validate cryptocurrency transactions, often leading to unauthorized resource usage when exploited.
Read the original article here: https://securityboulevard.com/2025/12/preventing-this-weeks-aws-cryptomining-attacks-why-detection-fails-and-permissions-matter/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
