The Discovery of a Massive Cryptomining Operation Leveraging GitHub Actions

Originally published by Sysdig on October 25, 2022. Written by Crystal Morin, Sysdig. The Sysdig Threat Research Team (Sysdig TRT) recently uncovered an extensive and sophisticated active cryptomining operation in which a threat actor is using some of the largest cloud and continuous integration and deployment (CI/CD) service providers; including GitHub, Heroku, Buddy.works, and others to build, run, scale, and operate their massive cloud operation. Because no one has yet reported on this act...

actions actor build cloud continuous continuous integration cryptomining crystal deployment discovery github github actions heroku integration october research run scale service service providers sysdig team threat threat actor threat research