AWS customers targeted by sophisticated IAM credential theft for crypto mining

As reported by The Hacker News, a sophisticated ongoing campaign is exploiting compromised Amazon Web Services (AWS) Identity and Access Management (IAM) credentials to facilitate unauthorized cryptocurrency mining operations.

The attack, detected on November 2, 2025, by Amazon's GuardDuty, utilizes novel persistence techniques to evade detection and hinder response efforts. Threat actors gain initial access using compromised IAM credentials with administrative privileges. They then conduct reconnaissance to assess resource quotas and permissions, notably using the "DryRun" flag with the RunInstances API to validate access without incurring costs. The campaign proceeds by creating IAM roles for autoscaling groups and Lambda functions, subsequently deploying malicious Docker images to ECS clusters for crypto mining. The attackers also create autoscaling groups configured to scale aggressively, aiming to maximize resource consumption on various EC2 instance types. A key tactic involves using ModifyInstanceAttribute to disable API termination, preventing victims from easily removing compromised instances.

This campaign highlights a significant advancement in cryptojacking methodologies, combining scripted exploitation of multiple AWS services with sophisticated persistence techniques like disabling instance termination. The use of compromised IAM credentials and the potential for further abuse, such as using SES for phishing, underscore the critical need for robust IAM controls, temporary credentials, multi-factor authentication, and the principle of least privilege for AWS customers. Continuous monitoring and enabling services like AWS GuardDuty are essential for detecting and responding to such advanced threats.

Source: The Hacker News