Cryptomining Attack Exploits AI Gateway Vulnerabilities in AWS

A recent cyber incident involved attackers compromising an AWS EC2 instance acting as an AI gateway for Amazon Bedrock, leading to the deployment of XMRig cryptomining malware. Researchers from Darktrace identified that the attackers gained access through brute-force login attempts on an exposed SSH port. The compromised instance was linked to an IAM role with significant permissions, raising concerns about potential data access and model manipulation. Although the immediate outcome was cryptomining, experts warn that AI gateways centralize access to sensitive identities and resources, making them attractive targets for more severe attacks. The incident reflects a broader trend of cloud security risks associated with AI technologies. Darktrace noted suspicious IAM activity following the initial breach, indicating attempts to establish persistence in the compromised environment.

Key Points: • Attackers exploited an AWS EC2 instance acting as an AI gateway, deploying XMRig malware. • Initial access likely gained through brute-force SSH login attempts on an exposed port. • AI gateways centralize sensitive access, increasing risks of data theft and model manipulation.