credential-stealer-activitycloud-service-vulnerabilityinitial-access-methoddata-exfiltration-method

Cloud Credential Stealer Expanded From AWS to Azure and GCP

Malware Intelligence · 2 sources · Updated 4mo ago · First seen Apr 11, 2025

Researchers reported that a cloud-focused credential theft campaign broadened beyond AWS to also target Microsoft Azure and Google Cloud Platform, using exposed Docker services as an initial access point. The activity, observed in June 2023 and detailed by SentinelLABS and Permiso, relied on modular shell scripts and a UPX-packed Golang ELF payload to collect cloud credentials, profile compromised hosts, inspect containers, and harvest environment variables from running processes.

The tooling also showed worm-like behavior by scanning for exposed Docker daemons on ports 2375 and 2376 with utilities including masscan and zgrab, then exfiltrating stolen data to AnonDNS-hosted infrastructure protected by hardcoded HTTP credentials. Researchers said the tradecraft overlaps with tooling previously linked to TeamTNT, but stopped short of firm attribution because the scripts are easily reused or modified; they assessed the actor is actively refining the malware for broader cloud-focused operations against Azure and GCP environments.

Hunt this familyPull IOCs and campaign context straight into your stack.

Get the IOCs

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 1, 2023 – Apr 11, 2025

Apr 11, 20252y ago
Researchers publish analysis and note uncertain TeamTNT overlap
SentinelLABS and Permiso published research describing the campaign's infrastructure, exfiltration methods, and tooling overlaps with activity previously associated with TeamTNT. They said attribution remains uncertain because the scripts are easily reused or modified.
Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP | SentinelOne
Apr 11, 20252y ago
Campaign expands from AWS to Azure and GCP credential theft
The tooling evolved beyond AWS to also steal credentials from Microsoft Azure and Google Cloud Platform. Researchers said the updated toolset added cloud-specific credential collection, container inspection, environment variable harvesting, and worm-like propagation via scanning exposed Docker daemons on ports 2375 and 2376.
Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP | SentinelOne
Jul 21, 20233y ago
SentinelOne links JumpCloud intrusion to North Korean APT activity
SentinelOne analyzed infrastructure tied to the July 2023 JumpCloud intrusion and assessed that the compromise was linked to a North Korean state-sponsored threat actor. The report cited domain patterns, passive DNS relationships, SSL certificate overlaps, and similarities to TraderTraitor and AppleJeus-linked infrastructure to support the attribution.
JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity | SentinelOne
Jun 1, 20233y ago
Cloud credential theft campaign targets exposed Docker services
Researchers analyzed a cloud credential theft campaign in June 2023 that targeted exposed Docker services to steal AWS credentials. The activity used modular shell scripts and a UPX-packed Golang ELF binary to collect and exfiltrate data.
Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP | SentinelOne

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Affected products

2 linked

Amazon Web ServicesDocker

Organizations

3 linked

Amazon Web ServicesMicrosoft CorporationGoogle

Observables

71 linked

Domain••••••.comSHA-1 hash••••••••••••••••••••••••••••••••••••••••IPv4 address•••.••.•••.•••URLhttps://••••••••.•••/•••••••Email address••••••••@•••••.•••Domain•••••••••••.ruSHA-1 hash••••••••••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••+63

Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Sentinelone LabsNews · Apr 11, 2025

Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP | SentinelOneOpen source ↗

Sentinelone LabsNews · Jul 21, 2023

JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity | SentinelOneOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News