Cryptocurrency miners are using compromised Google Cloud accounts for computationally-intensive mining purposes, Google has warned.
The search giant’s cybersecurity team provided details in a report published Wednesday. The so-called “Threat Horizons” report aims to provide intelligence that allows organizations to keep their cloud environments secure.
“Malicious actors were observed performing cryptocurrency mining within compromised Cloud instances,” Google wrote in an executive summary of the report.
Cryptocurrency mining is a for-profit activity that often requires large amounts of computing power, which Google Cloud customers can access at a cost. Google Cloud is a remote storage platform where customers can keep data and files off-site.
Google said 86% of 50 recently compromised Google Cloud accounts were used to perform cryptocurrency mining. In the majority of cases, cryptocurrency mining software was downloaded within 22 seconds of the account being compromised, Google said.
Around 10% of the compromised accounts were also used to conduct scans of other publicly available resources on the internet to identify vulnerable systems, while 8% of instances were used to attack other targets.
Google said malicious actors were able to access Google Cloud accounts by taking advantage of poor customer security practices. Almost half of the compromised accounts were attributed to actors gaining access to an internet-facing Cloud account which had either no password or a weak password. As a result, these Google Cloud accounts could be easily scanned and brute forced.
Around a quarter of the compromised accounts were due to vulnerabilities in third-party software that had been installed by the owner.
Bitcoin, the world’s most popular cryptocurrency, has been criticized for being too energy intensive. Bitcoin mining uses more energy than some entire countries. In May, police raided a suspected cannabis farm to find it was in fact an illegal bitcoin mine.
“The cloud threat landscape in 2021 was more complex than just rogue cryptocurrency miners, of course,” wrote Bob Mechler, director of the office of the chief information security officer at Google Cloud, and Seth Rosenblatt, security editor at Google Cloud, in a blog post.
They said Google researchers also exposed a phishing attack by Russian group APT28/Fancy Bear at the end of September, adding that Google blocked the attack.
Google researchers also identified a North Korean government-backed threat group which posed as Samsung recruiters to send malicious attachments to employees at several South Korean anti-malware cybersecurity companies, they added.
- Google said 86% of 50 recently compromised Google Cloud accounts were used to perform cryptocurrency mining.
- Cryptocurrency mining is a for-profit activity that often requires large amounts of computing power, which Google Cloud customers can access at a cost.
- “Malicious actors were observed performing cryptocurrency mining within compromised Cloud instances,” Google wrote in an executive summary of the report.
By CNBC
