Infrastructure Laundering: Blending in with the Cloud
Summary: Silent Push research published in October 2024 found that Funnull, a two-year-old Chinese content delivery network tied to Chinese organized crime gangs, was hosting fake trading apps, pig butchering scams, gambling sites and phishing pages through Amazon AWS and Microsoft Azure addresses. After acquiring the polyfill[.]io domain in summer 2024, Funnull ran a supply-chain attack that redirected visitors from tens of thousands of still-linking legitimate domains to malicious sites, and Silent Push said this month that dozens of the same Amazon and Microsoft cloud addresses were still forwarding Funnull traffic.
Why it matters: Defenders cannot wholesale block major cloud providers because a single IP can host thousands or tens of thousands of domains, and NETSCOUT's Richard Hummel said attackers cycling through new cloud accounts can do their damage within an hour of spinning one up. Amazon said it had suspended all known accounts linked to the activity and that the accounts used fraudulent methods to temporarily acquire infrastructure for which it never pays.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026