An ongoing cyber campaign has been identified targeting Amazon Web Services customers, with attackers exploiting compromised Identity and Access Management credentials to run unauthorised cryptocurrency mining operations.
The activity was first detected on 2 November 2025 by Amazon’s GuardDuty managed threat detection service and automated security monitoring systems. According to a report released by Amazon ahead of publication, the campaign employs previously unseen persistence techniques designed to frustrate incident response efforts and allow the attacks to continue largely uninterrupted.
“Operating from an external hosting provider, the threat actor quickly enumerated resources and permissions before deploying crypto mining resources across ECS and EC2,” Amazon said. “Within 10 minutes of the threat actor gaining initial access, crypto miners were operational.”
The attack begins when an unknown adversary uses compromised IAM credentials with administrative-style privileges to conduct an extensive discovery phase. This involves checking EC2 service quotas and testing permissions by calling the RunInstances API with the “DryRun” flag enabled.
Using the “DryRun” flag allows attackers to verify permissions without actually launching instances, helping them avoid immediate costs and leaving a smaller forensic footprint. This step enables the threat actor to determine whether the target environment can support the deployment of mining software.
The next stage sees the creation of new IAM roles for autoscaling groups and AWS Lambda services, using the CreateServiceLinkedRole and CreateRole functions. The attackers then attach the “AWSLambdaBasicExecutionRole” policy to the Lambda role to enable further activity.
In some attacks, dozens of ECS clusters were created across a single environment, with Amazon observing more than 50 clusters in certain cases. These clusters were used to deploy malicious task definitions that initiated cryptocurrency mining workloads.
“They then called RegisterTaskDefinition with a malicious DockerHub image yenik65958/secret:user,” Amazon said. “With the same string used for the cluster creation, the actor then created a service, using the task definition to initiate crypto mining on ECS Fargate nodes.”
The DockerHub image, which has since been removed, was designed to immediately run a shell script that launched mining activity using the RandomVIREL algorithm. The campaign also included the creation of aggressive autoscaling groups, set to expand from 20 up to 999 instances, targeting both GPU and machine learning instances as well as general-purpose compute resources.
A key feature of the campaign is the abuse of instance termination protection by setting the “disableApiTermination” parameter to true. This prevents affected instances from being deleted through standard management tools.
“Instance termination protection can impair incident response capabilities and disrupt automated remediation controls,” Amazon said. “This technique demonstrates an understanding of common security response procedures and intent to maximize the duration of mining operations.”
The attacks also involved creating an open Lambda function and a new IAM user with full access to Amazon’s Simple Email Service, potentially enabling further abuse such as phishing campaigns.
