leaked-secret-api-keycloud-misconfigurationcredential-access-methodcryptocurrency-platform-risk

Exposed AWS IAM Keys Fueled Cryptojacking and Cloud Resource Abuse

Breach & Incident Intelligence · 3 sources · Updated 4mo ago · First seen May 25, 2026

Palo Alto Networks Unit 42 reported that exposed AWS IAM access keys were used in malicious operations that rapidly turned compromised cloud accounts into platforms for cryptojacking and broader resource abuse. Attackers leveraged valid IAM credentials to gain access without exploiting software flaws, then provisioned compute resources and manipulated cloud services to mine cryptocurrency while consuming victims’ infrastructure and budget.

The activity highlights how leaked cloud credentials can enable fast, low-friction compromise across internet-facing environments, especially when keys are overprivileged or insufficiently monitored. Unit 42’s findings underscore that exposed IAM keys can support sustained unauthorized operations inside cloud tenants, making credential hygiene, least-privilege access, key rotation, and continuous monitoring of anomalous cloud activity critical defensive measures.

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jun 4, 2021 – Oct 30, 2023

Oct 30, 20233y ago
Unit 42 publishes research on malicious use of exposed IAM keys
Palo Alto Networks Unit 42 published a report titled "CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys," describing malicious operations involving exposed cloud IAM keys, including cryptojacking activity.
Dec 8, 20224y ago
Unit 42 publishes case studies on compromised cloud compute credentials
Palo Alto Networks Unit 42 published research titled "Compromised Cloud Compute Credentials: Case Studies From the Wild," documenting real-world cases involving compromised cloud compute credentials. The report represents an earlier disclosure of cloud credential abuse activity preceding its later IAM key research.
Compromised Cloud Compute Credentials: Case Studies From the Wild
Jun 4, 20215y ago
Unit 42 reports TeamTNT actively enumerating cloud environments
Palo Alto Networks Unit 42 published research describing TeamTNT operations targeting cloud environments and actively enumerating cloud resources. The report documents an earlier phase of cloud-focused threat activity preceding Unit 42's later publications on compromised compute credentials and exposed IAM keys.
TeamTNT Operations Actively Enumerating Cloud Environments

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Palo Alto Networks Unit 42 BlogNews · Oct 30, 2023

CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM KeysOpen source ↗

Palo Alto Networks Unit 42 BlogNews · Dec 8, 2022

Compromised Cloud Compute Credentials: Case Studies From the WildOpen source ↗

Palo Alto Networks Unit 42 BlogNews · Jun 4, 2021

TeamTNT Operations Actively Enumerating Cloud EnvironmentsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Exposed AWS IAM Keys Fueled Cryptojacking and Cloud Resource Abuse

How this story unfolded

Unit 42 publishes research on malicious use of exposed IAM keys

Unit 42 publishes case studies on compromised cloud compute credentials

Unit 42 reports TeamTNT actively enumerating cloud environments

Sources

See the full picture, correlated to your attack surface.

Related stories

Cryptomining Campaign Leveraging Compromised AWS IAM Credentials

Publicly Exposed AWS Keys Left Thousands of Corporate Accounts at Risk

Crimson Collective APT Hijacks AWS Accounts Using Leaked IAM Keys for Data Theft

Exposed AWS IAM Keys Fueled Cryptojacking and Cloud Resource Abuse

How this story unfolded

Unit 42 publishes research on malicious use of exposed IAM keys

Unit 42 publishes case studies on compromised cloud compute credentials

Unit 42 reports TeamTNT actively enumerating cloud environments

Sources

See the full picture, correlated to your attack surface.

Related stories

Cryptomining Campaign Leveraging Compromised AWS IAM Credentials

Publicly Exposed AWS Keys Left Thousands of Corporate Accounts at Risk

Crimson Collective APT Hijacks AWS Accounts Using Leaked IAM Keys for Data Theft