Financially motivated

GUI-vil

Also tracked as p0-LUCR-1

GUI-vil, also tracked as p0-LUCR-1, is a financially motivated group from Indonesia tracked by Permiso. It uses exposed AWS keys to gain access through the S3 Browser tool and the AWS Management Console. Its goal is running EC2 instances for cryptomining.

Cloud tradecraft

Harvests exposed AWS access keys from GitHub and Pastebin
Validates stolen keys and operates through the AWS Management Console
Creates IAM users and login profiles to blend in and persist
Attaches inline IAM policies granting full administrator privileges
Reads S3 buckets and tfstate files to find admin credentials
Runs large EC2 instances for cryptomining across regions

MITRE ATT&CK techniques

T1078.004 T1136.003 T1098.001 T1098.003 T1530 T1496

References

Unmasking GUI-vil: Financially Motivated Cloud Threat Actor

Prevent these techniques in your AWS accounts

Pathbreak validates which of these techniques resolve against your real AWS authorization and gives you the change that breaks each path, so an attacker cannot chain it.

Request a free scan Browse the attack map