Crypto crooks co-opt stolen AWS creds to mine coins

AWS customers are being targeted by an ongoing cryptomining campaign that leverages stolen IAM credentials to rapidly deploy SBRMiner-MULTI across EC2 and ECS. Attackers probe service quotas, create numerous ECS clusters and auto-scaling groups to maximize resource usage, set DisableApiTermination on instances to hinder removal, and establish persistence via unauthenticated Lambda Function URLs; Amazon GuardDuty detected a number of affected accounts and Amazon recommends enforcing MFA, least privilege, and temporary credentials.