Cryptomining Campaign Leveraging Compromised AWS IAM Credentials

A coordinated cryptocurrency mining campaign has been detected targeting Amazon Web Services (AWS) customers by exploiting compromised Identity and Access Management (IAM) credentials. The attackers used these credentials to gain unauthorized access to Amazon Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments, rapidly deploying crypto mining operations within minutes of initial access. Amazon GuardDuty and AWS's automated security monitoring systems identified the campaign, which began on November 2, 2025, and observed the use of novel persistence techniques designed to disrupt incident response and prolong mining activities. The attackers operated from external hosting providers, quickly enumerating service quotas and permissions before launching mining resources, and in some cases, created dozens of ECS clusters in a single attack.

The threat actors employed advanced tactics such as using the "DryRun" flag with the RunInstances API to validate permissions without launching instances, minimizing their forensic footprint. They also created new IAM roles and attached policies to facilitate the deployment and persistence of mining workloads. AWS emphasized that the campaign did not exploit vulnerabilities in AWS services themselves but relied on the misuse of valid credentials, underscoring the importance of strong credential management and monitoring. AWS has provided mitigation guidance and detection recommendations to help customers defend against similar attacks in the future.