Google Cloud Cryptomined

Google Cloud has shared that malicious actors had recently compromised 50 Google Cloud Platform instances, a majority (86%) of which were used for cryptocurrency mining.

Google notes that an analysis of the compromised cloud instances that were used for illicit mining revealed that in 58% of situations the cryptocurrency mining software was downloaded to the system within 22 seconds of being compromised

The initial attacks and subsequent downloads were scripted events not requiring human intervention. The ability to manually intervene in these situations to prevent exploitation is nearly impossible. The best defense would be to not deploy a vulnerable system or have automated response mechanisms.

Most of the compromised instances were used for cryptocurrency mining rather than exfiltration of data, Google analysts fathom that the attackers scanned a range of Google Cloud IP addresses, rather than targeting particular customers.

The search engine giant claims the objective of the report is to provide actionable intelligence to help organizations ensure that their cloud environments remain protected against ever-evolving threats.

The report also revealed that 10% of the compromised Cloud instances were used to conduct scans of other publicly available resources on the Internet in order to identify vulnerable systems, and 8% of instances were used to attack other targets.