Attackers Use Stolen AWS Credentials in Cryptomining Campaign

Attackers have been using compromised AWS Identity and Access Management (IAM) credentials to target cloud services in a cryptomining campaign that deploys miners across Amazon EC2 and Amazon ECS infrastructure, according to a blog post published by AWS. Security researchers identified the activity in early November with GuardDuty and automated monitoring, and note that the attackers used stolen credentials to obtain administrator privileges rather than exploiting a vulnerability in AWS itself.

The operation moved quickly, with cryptomining resources deployed across EC2 and ECS about 10 minutes after the initial access. The campaign also features an advanced persistence technique that disables API termination protection, complicating incident response, and uses specific instance naming patterns that may indicate cryptomining infrastructure. AWS advises strong IAM controls, temporary credentials, MFA for all users, and using CloudTrail logs to monitor and correlate activity across services.