CLOUDKEYS IN THE AIR: TRACKING MALICIOUS OPERATIONS OF EXPOSED IAM KEYS

Summary from the TLDR InfoSec newsletter

This post details an active cryptojacking campaign abusing exposed AWS credentials on GitHub. The actor creates EC2 miners within minutes of secrets being posted leveraging cloud automation for scale. It goes into detail on how the actor implemented honeypots to monitor and reveals 474 miner instances between August and October.