Financially motivated

AMBERSQUID

AMBERSQUID is a cloud native cryptojacking operation tracked by Sysdig that abuses less common AWS services to mine cryptocurrency. It runs miners through Amplify, CodeBuild, CloudFormation, SageMaker, ECS Fargate, and EC2 Auto Scaling. Spreading across services helps it avoid the quota approvals that EC2 spam would trigger.

Cloud tradecraft

Uses compromised AWS credentials to provision cloud resources
Creates IAM roles and attaches full access policies for multiple services
Runs miners inside Amplify, CodeBuild, and SageMaker build jobs
Deploys miner containers on ECS Fargate across many regions
Launches EC2 Auto Scaling groups to scale mining compute

MITRE ATT&CK techniques

T1078.004 T1098.003 T1578.002 T1496 T1610

References

AWS's Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation

Prevent these techniques in your AWS accounts

Pathbreak validates which of these techniques resolve against your real AWS authorization and gives you the change that breaks each path, so an attacker cannot chain it.

Request a free scan Browse the attack map