Locked Out of the Cloud: Hackers Use AWS Termination Protection to Hijack ECS for Unstoppable Crypto Mining

According to Amazon GuardDuty, cybercriminals began a coordinated campaign on 2 November 2025 to hijack AWS resources such as Amazon EC2 and Amazon ECS using compromised IAM credentials to run unauthorised cryptocurrency mining. The attackers operated from an external hosting provider, carrying out rapid reconnaissance and deployment, and reportedly had miners running within 10 minutes of gaining initial access.

They tested permissions with the DryRun flag on API calls before actually deploying resources, a tactic described as deliberate reconnaissance. Once established, the miners were spun up using a malicious Docker image (yenik65958/secret) that had been pulled over 100,000 times, and the attackers enabled ModifyInstanceAttribute with termination protection set to true to complicate remediation.

This termination protection created a hurdle for automated security scripts and responders, effectively buying the actors time to expand their mining operations, while they also set the stage for a backdoor via AWS Lambda and explored a future phishing campaign using Amazon SES.