Anatomy of an AWS Account Cryptojack
summary
One CHT customer’s AWS development account gets hijacked and generates about $40k in EC2 charges as roughly 100 top-end Windows instances run at 100% CPU for two weeks mining cryptocurrency. Forensics show no CloudTrail, an admin credential leak where one access key rotated and automated tooling spins up pre-baked AMIs across regions while attempting to frame another user. Reconstruction comes from governance backups. Preventive specifics: enforce MFA and external IdP, prefer instance profiles/IAM roles, and enable centralized CloudTrail and cost alerts.
AI-written summary · about
chapters (20)
- 0:00AWS cryptojacking incident overview
- 1:25What is cryptojacking
- 3:07AWS account takeover effects
- 4:14Cryptojacking attack timeline
- 6:05Forensic analysis of attack
- 8:09Why attackers rotate access keys
- 9:33Prevent AWS account compromises with MFA
- 11:24IAM roles and permissions best practices
- 13:12AWS account limits and CloudTrail
- 14:57Real-time monitoring for suspicious activity
- 16:01Key takeaways to secure AWS
- 17:32Financial impact of cryptojacking
- 18:16Automation in cryptojacking attacks
- 19:21MFA on mobile and root accounts
- 19:46Securing automation and robot accounts
- 20:29Logistical cleanup after attack
- 21:31Developer mistake causing token exposure
- 23:20MFA token storage risks
- 24:23Abuse of AWS keys and secrets
- 25:51Service account access in containers
related talks
16mLessons from the SOC: Analyzing and remediating cloud attack paths
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
46mAttacking AWS: The Full Cyber Kill Chain
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
43mThink like a HACKER
35mAccount Jumping Post Infection Persistency & Lateral Movement in AWS
35mThe Dark Side of Cloud Computing: How Threat Actors Abuse Millions of Dollars of Cloud Compute