Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Compromised Cloud Compute Credentials: Case Studies From the Wild

Summary: Unit 42 documented two cloud compute credential thefts: in one, an attacker stole an AWS Lambda function's credentials, enumerated services across regions, and used the victim's AWS Simple Email Service to launch a phishing campaign before deleting the SES identity. In the other, a stolen default Google Cloud App Engine service account with the Project Editor role was used to add a compute/admin role, create a firewall rule at priority zero, and spin up more than 1,600 VMs with four GPUs each for cryptomining, with the attacker creating multiple service account keys in anticipation of revocation.

Bottom line: The App Engine service account carried the Project Editor role by default, and that single over-privileged identity was enough for an attacker to launch over 1,600 GPU-equipped VMs on the victim's bill. In the Lambda case, the attacker's calls came from IP 50.82.94[.]112 rather than the function's own address - the kind of signal that only cloud audit logging surfaces, and serverless workloads cannot take an agent to catch it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Cloud Security
Related