Retour 
Cryptojacking has become the favorite tool for cybercriminals to mine cryptocurrencies on the systems and/or computing resources hosted over IaaS infrastructures like Amazon AWS, Microsoft Azure, and Google Cloud. Netskope threat research labs has discovered attack patterns where Internet-facing infrastructures hosted on the cloud, have been targeted by cybercriminals to look for security holes that can be exploited to gain access to the services. Once they gain control over the computer resources, they can then be utilized for illegal mining of cryptocurrencies. In our previous few blogs about cryptocurrency mining, we detailed about how cryptojackers are targeting enterprises and consumers to infect their machines and capitalize its resources for mining. In this post, we want to shed some light on how cloud-based infrastructures are also on the radar of cybercriminals for illegal mining. The advantage that these cloud infrastructures provide is the high availability and powerful computing resources that can enable miners to quickly solve the compute-intensive mining problem.
Attack methodology
Netskope Threat Research Labs has noticed attackers attempting to scan for cloud provider IP ranges to map out reachable services like ssh logins to servers in public cloud, kubernetes clusters and other orchestron services hosting cloud applications. This gives them a list of machines to target at. We noticed multiple login brute-forcing attempts on the open ports/services, specifically on ports running logon instances like SSH as shown in figure 1 below.
Figure 1: Login attempts made by the attacker IP
Another instance of attack captured in a Netskope monitored cloud environment was exploitation attempts against the hosted Drupal service, attempting to execute known vulnerabilities in the web application, as shown in figure 2 below.
