Loading story…
Palo Alto Networks Unit 42 reported that exposed AWS IAM access keys were used in malicious operations that rapidly turned compromised cloud accounts into platforms for cryptojacking and broader resource abuse. Attackers leveraged valid IAM credentials to gain access without exploiting software flaws, then provisioned compute resources and manipulated cloud services to mine cryptocurrency while consuming victims’ infrastructure and budget.
The activity highlights how leaked cloud credentials can enable fast, low-friction compromise across internet-facing environments, especially when keys are overprivileged or insufficiently monitored. Unit 42’s findings underscore that exposed IAM keys can support sustained unauthorized operations inside cloud tenants, making credential hygiene, least-privilege access, key rotation, and continuous monitoring of anomalous cloud activity critical defensive measures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a report titled "CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys," describing malicious operations involving exposed cloud IAM keys, including cryptojacking activity.
Palo Alto Networks Unit 42 published research titled "Compromised Cloud Compute Credentials: Case Studies From the Wild," documenting real-world cases involving compromised cloud compute credentials. The report represents an earlier disclosure of cloud credential abuse activity preceding its later IAM key research.
Palo Alto Networks Unit 42 published research describing TeamTNT operations targeting cloud environments and actively enumerating cloud resources. The report documents an earlier phase of cloud-focused threat activity preceding Unit 42's later publications on compromised compute credentials and exposed IAM keys.
3 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated cryptocurrency mining campaign has been detected targeting Amazon Web Services (AWS) customers by exploiting compromised Identity and Access Management (IAM) credentials. The attackers used these credentials to gain unauthorized access to Amazon Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments, rapidly deploying crypto mining operations within minutes of initial access. Amazon GuardDuty and AWS's automated security monitoring systems identified the campaign, which began on November 2, 2025, and observed the use of novel persistence techniques designed to disrupt incident response and prolong mining activities. The attackers operated from external hosting providers, quickly enumerating service quotas and permissions before launching mining resources, and in some cases, created dozens of ECS clusters in a single attack. The threat actors employed advanced tactics such as using the "DryRun" flag with the RunInstances API to validate permissions without launching instances, minimizing their forensic footprint. They also created new IAM roles and attached policies to facilitate the deployment and persistence of mining workloads. AWS emphasized that the campaign did not exploit vulnerabilities in AWS services themselves but relied on the misuse of valid credentials, underscoring the importance of strong credential management and monitoring. AWS has provided mitigation guidance and detection recommendations to help customers defend against similar attacks in the future.
Jun 29, 2026
The Crimson Collective, a newly identified advanced persistent threat (APT) group, has been observed targeting Amazon Web Services (AWS) environments to steal sensitive data. Security researchers have reported that the group specializes in exploiting leaked AWS Identity and Access Management (IAM) keys, which are often sourced from exposed code repositories or misconfigured cloud environments. Using tools like TruffleHog, the attackers systematically search for and validate AWS credentials that have been inadvertently published or left unprotected. Once a valid access key is identified, the group leverages the GetCallerIdentity API call to confirm its usability and gain initial access to the victim's AWS account. The attackers then establish persistence by creating new IAM users, login profiles, and additional access keys, effectively embedding themselves within the compromised environment. To maximize their control, Crimson Collective attaches the AWS-managed AdministratorAccess policy to these new accounts, granting themselves full administrative privileges. In scenarios where immediate administrative access is not available, the group uses the SimulatePrincipalPolicy API to analyze existing permissions and identify pathways for privilege escalation. This methodical approach allows the attackers to conduct extensive reconnaissance, manipulate cloud resources, and exfiltrate sensitive data without detection. The group’s operations demonstrate a sophisticated understanding of AWS’s internal mechanisms and highlight the risks associated with overly permissive IAM policies. Victims of these attacks face significant threats, including data theft, extortion, and potential disruption of cloud-based services. The incident underscores the importance of securing access credentials, regularly auditing IAM policies, and monitoring for unusual API activity within cloud environments. Security experts recommend immediate revocation of exposed keys, implementation of least-privilege access models, and the use of automated tools to detect credential leaks. The emergence of Crimson Collective signals an escalation in targeted attacks against cloud infrastructure, emphasizing the need for robust cloud security practices. Organizations are urged to review their AWS configurations and ensure that sensitive credentials are never stored in public or unsecured locations. The attack chain employed by Crimson Collective serves as a cautionary example of how mismanaged cloud security can lead to severe breaches. Ongoing investigations aim to determine the full scope of affected organizations and the extent of data exfiltration. The cybersecurity community continues to monitor the group’s activities and share indicators of compromise to help defend against similar threats. This incident highlights the evolving tactics of APT groups in targeting cloud environments and the critical need for proactive defense measures.
Jul 12, 2026
Threat actors are actively exploiting **intentionally vulnerable web applications** used for security training and internal testing (including **DVWA**, **OWASP Juice Shop**, **Hackazon**, and **bWAPP**) when they are mistakenly exposed to the public Internet, using them as an entry point into enterprise cloud environments. Reporting based on a Pentera investigation described evidence of real-world abuse leading to follow-on activity such as **cryptominer deployment**, **webshell placement**, and **pivoting** deeper into sensitive systems—especially when these apps are deployed from **privileged cloud accounts** and paired with weak configurations. Pentera reported finding **1,926** live exposed instances across **AWS, GCP, and Azure**, frequently associated with **over-permissioned IAM roles** and poor hygiene such as **default credentials** and failure to follow least-privilege practices. The exposed environments could enable access to cloud storage (e.g., **S3**, **GCS**, **Azure Blob Storage**), secrets stores (e.g., **AWS Secrets Manager**), container registries, and in some cases **administrative control** of cloud accounts; impacted organizations cited in coverage included major vendors such as **Cloudflare**, **F5**, and **Palo Alto Networks**, which were notified and reportedly remediated affected exposures.
Jun 29, 2026