The Anatomy of a Google Cloud (GCP) Cryptomining Attack - Default Service Account Compromise

GCP Service Accounts are interesting cloud identities. Let's go over how they led to a Cryptomining Attack in this Attack Case.

Report: https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/

_____________
🧬 VIDEO RESOURCES

🔹How A Compromised AWS Lambda Function Led to a Phishing Attack: https://youtu.be/rdwl49cN3Vk
🔹GCP Lateral Movement & PrivEsc: https://www.youtube.com/watch?v=Ml09R38jpok
🔹GCP Service Accounts: https://cloud.google.com/compute/docs/access/service-accounts
🔹 DEFCON 30 Cloud Village - Weather Proofing GCP Defaults: https://www.youtube.com/watch?v=7t29F8nIAt8
🔹GCP IAM basic and predefined roles reference: https://cloud.google.com/iam/docs/understanding-roles


_____________
💼 CAREER RESOURCES

🔹Check out these Cybersecurity Notion Templates for planning …

access account account compromise accounts attack career case cloud compromise credentials cryptomining default defense detection escalation evasion firewall flow gcp google google cloud identities initial access led modification opportunity permission privilege privilege escalation resources service service accounts stolen video work