Amazon: Ongoing cryptomining campaign uses hacked AWS accounts

Amazon's AWS GuardDuty security team has identified an ongoing cryptomining campaign targeting AWS infrastructure. The attack specifically focuses on Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) instances. Attackers are using compromised credentials for Identity and Access Management (IAM) to gain unauthorized access. The campaign represents an active threat to AWS customers with potential for significant resource abuse and financial impact. Organizations using AWS services should review their IAM security posture and monitor for unusual compute activity.