CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys

We analyze an attack path starting with GitHub IAM exposure and leading to creation of AWS Elastic Compute instances — which TAs used to perform cryptojacking.

The post CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys appeared first on Unit 42.

air attack attack path aws cloud compute cortex cryptojacking cybercrime elastic exposed exposed credentials exposure github iam keys malicious operations path prisma cloud tracking unit 42