Loading story…
A coordinated cryptocurrency mining campaign has been detected targeting Amazon Web Services (AWS) customers by exploiting compromised Identity and Access Management (IAM) credentials. The attackers used these credentials to gain unauthorized access to Amazon Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments, rapidly deploying crypto mining operations within minutes of initial access. Amazon GuardDuty and AWS's automated security monitoring systems identified the campaign, which began on November 2, 2025, and observed the use of novel persistence techniques designed to disrupt incident response and prolong mining activities. The attackers operated from external hosting providers, quickly enumerating service quotas and permissions before launching mining resources, and in some cases, created dozens of ECS clusters in a single attack.
The threat actors employed advanced tactics such as using the "DryRun" flag with the RunInstances API to validate permissions without launching instances, minimizing their forensic footprint. They also created new IAM roles and attached policies to facilitate the deployment and persistence of mining workloads. AWS emphasized that the campaign did not exploit vulnerabilities in AWS services themselves but relied on the misuse of valid credentials, underscoring the importance of strong credential management and monitoring. AWS has provided mitigation guidance and detection recommendations to help customers defend against similar attacks in the future.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
AWS published technical details of the campaign, describing the attackers' automation, persistence methods, and recommended incident response steps. The disclosure emphasized that the activity relied on stolen credentials, not flaws in AWS services.
The Docker Hub image yenik65958/secret used in the campaign was taken down after being identified as part of the operation. AWS warned that similar attacks could continue using different images or accounts.
Amazon GuardDuty, including Extended Threat Detection and Runtime Monitoring, identified the coordinated activity and enabled AWS to notify affected customers. AWS advised actions such as credential rotation, stronger IAM controls, MFA, least privilege, and monitoring for suspicious API usage.
Beyond mining, the attackers created Lambda functions and sought SES access, indicating efforts to establish broader malicious infrastructure and possible phishing capability inside compromised AWS accounts. This showed the campaign extended beyond simple resource hijacking for mining.
The campaign introduced a notable persistence technique by modifying EC2 instance attributes to disable API termination, making compromised instances harder for defenders to shut down. Reporting also described this as abuse of AWS termination protection to sustain ECS-related mining operations.
After gaining access, the attackers enumerated victim resources and quickly launched large-scale cryptomining infrastructure using both ECS and EC2, including Spot and On-Demand instances and auto-scaling configurations. They used the Docker Hub image yenik65958/secret, which contained the SBRMiner-MULTI cryptominer.
A coordinated campaign targeting AWS customers began on 2025-11-02, with attackers using compromised IAM credentials rather than exploiting AWS service vulnerabilities. The activity focused on Amazon EC2 and Amazon ECS environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcebleepingcomputer.com
Open sourceaws.amazon.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that exposed AWS IAM access keys were used in malicious operations that rapidly turned compromised cloud accounts into platforms for **cryptojacking** and broader resource abuse. Attackers leveraged valid IAM credentials to gain access without exploiting software flaws, then provisioned compute resources and manipulated cloud services to mine cryptocurrency while consuming victims’ infrastructure and budget. The activity highlights how leaked cloud credentials can enable fast, low-friction compromise across internet-facing environments, especially when keys are overprivileged or insufficiently monitored. Unit 42’s findings underscore that exposed IAM keys can support sustained unauthorized operations inside cloud tenants, making credential hygiene, least-privilege access, key rotation, and continuous monitoring of anomalous cloud activity critical defensive measures.
Jul 12, 2026
The Crimson Collective, a newly identified advanced persistent threat (APT) group, has been observed targeting Amazon Web Services (AWS) environments to steal sensitive data. Security researchers have reported that the group specializes in exploiting leaked AWS Identity and Access Management (IAM) keys, which are often sourced from exposed code repositories or misconfigured cloud environments. Using tools like TruffleHog, the attackers systematically search for and validate AWS credentials that have been inadvertently published or left unprotected. Once a valid access key is identified, the group leverages the GetCallerIdentity API call to confirm its usability and gain initial access to the victim's AWS account. The attackers then establish persistence by creating new IAM users, login profiles, and additional access keys, effectively embedding themselves within the compromised environment. To maximize their control, Crimson Collective attaches the AWS-managed AdministratorAccess policy to these new accounts, granting themselves full administrative privileges. In scenarios where immediate administrative access is not available, the group uses the SimulatePrincipalPolicy API to analyze existing permissions and identify pathways for privilege escalation. This methodical approach allows the attackers to conduct extensive reconnaissance, manipulate cloud resources, and exfiltrate sensitive data without detection. The group’s operations demonstrate a sophisticated understanding of AWS’s internal mechanisms and highlight the risks associated with overly permissive IAM policies. Victims of these attacks face significant threats, including data theft, extortion, and potential disruption of cloud-based services. The incident underscores the importance of securing access credentials, regularly auditing IAM policies, and monitoring for unusual API activity within cloud environments. Security experts recommend immediate revocation of exposed keys, implementation of least-privilege access models, and the use of automated tools to detect credential leaks. The emergence of Crimson Collective signals an escalation in targeted attacks against cloud infrastructure, emphasizing the need for robust cloud security practices. Organizations are urged to review their AWS configurations and ensure that sensitive credentials are never stored in public or unsecured locations. The attack chain employed by Crimson Collective serves as a cautionary example of how mismanaged cloud security can lead to severe breaches. Ongoing investigations aim to determine the full scope of affected organizations and the extent of data exfiltration. The cybersecurity community continues to monitor the group’s activities and share indicators of compromise to help defend against similar threats. This incident highlights the evolving tactics of APT groups in targeting cloud environments and the critical need for proactive defense measures.
Jul 12, 2026
Sysdig reported observing an offensive operation against an **AWS** environment in which a threat actor progressed from initial access to **administrative privileges in under 10 minutes**, with multiple indicators suggesting **large language models (LLMs)** were used to accelerate reconnaissance, code generation, and decision-making. Initial access was obtained via **valid credentials exposed in public S3 buckets**, reportedly associated with AI/RAG-related data and an IAM user used to automate *Amazon Bedrock* tasks via *AWS Lambda*. The actor then escalated privileges via **Lambda function code injection**, moved laterally across **19 AWS principals**, and abused *Amazon Bedrock* in an **LLMjacking** pattern while also provisioning **GPU-capable compute instances** for suspected model-related activity. Dark Reading’s coverage echoed Sysdig’s findings, emphasizing the speed of the compromise, the role of AI as a force multiplier, and post-compromise activity including **data collection/exfiltration** and **GPU instance provisioning**. In contrast, TechTarget’s “must-have security technologies” piece and SecuritySenses’ discussion of borrowing financial risk models for security are **general guidance/trend** articles and do not describe this specific intrusion or provide incident-specific technical details, making them non-contributory to the reported AWS compromise.
Jun 29, 2026