Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign

An ongoing AWS crypto mining campaign has been observed using compromised Identity and Access Management credentials to fuel mining across ECS and EC2 resources. Detected on 2 November 2025 by Amazon’s GuardDuty, the operation quickly enumerates permissions and deploys crypto miners within minutes of initial access. According to Amazon, the attacker created dozens of ECS clusters—in some cases more than 50 in a single attack—and used a malicious DockerHub image to launch mining on ECS Fargate nodes.

The campaign also sequenced IAM role creation and autoscaling group deployment, attaching the AWSLambdaBasicExecutionRole policy to the Lambda role, and even used ModifyInstanceAttribute with disableApiTermination set to True to prevent termination of compromised instances. The attackers leverage DryRun in RunInstances to test permissions before launching resources, and have been observed targeting high‑end GPU and ML compute instances across EC2.

Amazon also notes the use of a Lambda function and an IAM user with broad SES access to facilitate phishing and broader access, while the firm urges steps such as enforcing PoLP, temporary credentials, MFA and CloudTrail monitoring to curb the threat.