Amazon Web Services has disclosed details of an ongoing cryptomining campaign that targets Amazon EC2 and Amazon ECS environments using compromised AWS Identity and Access Management credentials. The campaign was described in a December 16 post on the AWS Security Blog and was first observed beginning on November 2.
AWS emphasized that the activity does not involve exploitation of a vulnerability in AWS services. Instead, the attacker relied on valid IAM credentials that had been obtained by an unauthorized actor, placing the activity squarely within the shared responsibility model. According to AWS, the actor was able to enumerate IAM permissions and EC2 service quotas shortly after gaining access, and in some cases deployed cryptomining workloads within approximately ten minutes.
AWS observed repeated use of RunInstances API calls with the DryRun flag, allowing the attacker to confirm permissions without launching instances. Once access was validated, the actor deployed miners across both ECS and EC2. In ECS environments, AWS reported the creation of large numbers of ECS clusters, sometimes exceeding 50, followed by registration of task definitions that referenced a malicious container image and the launch of services using Fargate and Fargate Spot. In EC2 environments, the attacker created launch templates and auto scaling groups with aggressive scaling parameters, including very high maximum instance counts, spanning both Spot and On-Demand capacity.
AWS described several techniques it characterized as sophisticated. One involved setting disable API termination to true on EC2 instances, forcing responders to explicitly re-enable termination before resources could be deleted. AWS also reported that the actor created a Lambda function URL with AuthType set to NONE, making it publicly accessible, and added permissions allowing any principal to invoke it. In addition, AWS observed creation of an IAM user with AmazonSESFullAccess, which AWS suggested could indicate intent to abuse Simple Email Service for phishing.
AWS published indicators of compromise, including a malicious Docker Hub image, automation patterns consistent with the AWS SDK for Python, and mining-related domains. For detection, AWS highlighted GuardDuty findings and runtime monitoring. Mitigation guidance focused on temporary credentials, multi-factor authentication, least-privilege IAM policies, and service control policies that explicitly restrict risky configurations.
Sources: AWS Security Blog
—
By Ji-seo Kim
