TGTGInsighttelegram intelligenceLIVE / telegram public index
TGINSIGHT POST
Post #8075
@thehackernews
The Hacker News
Post content
Post content
🛑 Amazon flagged a new AWS crypto-mining campaign using custom persistence techniques. Attackers validate permissions with DryRun, deploy miners across ECS and EC2, then enable instance termination protection to block cleanup. 🔗 Learn more: https://thehackernews.com/2025/12/compromised-iam-credentials-power-large.html