Cloud Keys in the Air: Tracking Malicious Operations of Exposed IAM Keys
Summary: Unit 42 researchers documented an active campaign they call EleKtra-Leak in which an actor scanned public GitHub repositories for exposed AWS IAM credentials and used them to launch cryptojacking EC2 instances, detecting and using the keys within five minutes of exposure and beginning reconnaissance four minutes after AWS applied its quarantine policy. The researchers observed 474 unique miners that were potentially actor-controlled EC2 instances between Aug. 30 and Oct. 6, 2023, and believe the operation has been active since at least December 2020.
Key Takeaway: The actor used large-format c5a.24xlarge instances and made more than 400 API calls across multiple regions in seven minutes, so the window between a leaked key and resource theft is measured in minutes, not days. Unit 42 also reports that 83% of organizations expose hard-coded credentials within production code repositories.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026