Financially motivated

EleKtra-Leak

EleKtra-Leak illustrated as a electric ray

EleKtra-Leak is an automated cloud cryptojacking campaign tracked by Unit 42 that scans public GitHub repositories for exposed AWS IAM keys. Within minutes of a key being committed it creates EC2 instances across regions. The instances then mine Monero at the victim expense.

Cloud tradecraft

  • Harvests AWS IAM access keys exposed in public GitHub repositories
  • Uses stolen long term access keys for initial cloud access
  • Enumerates the AWS account and avoids keys under AWS quarantine policy
  • Creates many large EC2 instances across regions
  • Runs Monero miners on the provisioned instances

MITRE ATT&CK techniques

T1078.004T1552.001T1580T1578.002T1496

References

Prevent these techniques in your AWS accounts

Pathbreak validates which of these techniques resolve against your real AWS authorization and gives you the change that breaks each path, so an attacker cannot chain it.

Request a free scan Browse the attack map