Threat actors are compromising cloud accounts in order to create distributed workloads for cryptomining — compromising misconfigured and vulnerable cloud instances for executing distributed denial-of-service (DDoS) attacks and abusing trial accounts from DevOps service providers.
A Romanian group, dubbed Outlaw, compromises Internet of Things (IoT) devices and Linux servers and containers by rudimentarily exploiting known vulnerabilities and using stolen or default credentials to mine the Monero digital currency or execute DDoS attacks. A more sophisticated group, TeamTNT, targets vulnerable software services; it ramped up attacks starting last November while claiming it would halt operations.
