Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP

By Alex Delamotte, with Ian Ahl (Permiso) and Daniel Bohannon (Permiso)

Executive Summary

• Throughout June 2023, an actor behind a cloud credentials stealing campaign has expanded their tooling to target Azure and Google Cloud Platform (GCP) services. Previously, this actor focused exclusively on Amazon Web Services (AWS) credentials.


• Cloud service credentials are increasingly targeted as actors find more ways to profit from compromising such services. This actor targeted exposed Docker instances to deploy a worm-like propagation module.


• These campaigns share …

actor alex amazon amazon web services aws azure campaign cloud cloud platform credentials daniel executive gcp google google cloud google cloud platform ian june june 2023 malware analysis permiso platform services stealer stealing target targeting tooling web web services