AmberSquid campaign (Campaign)
ID: 20053ae1-0e1c-53c3-8161-febb34f3d5d5
STIX ID: report--20053ae1-0e1c-53c3-8161-febb34f3d5d5
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2023-09-18
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
Researchers uncovered a cloud-focused cryptojacking campaign (May 2022–March 2023) that targeted AWS services including Amplify, Fargate/ECS, and Amazon SageMaker. Attackers distributed cryptominer binaries via backdoored Docker images on Docker Hub and later hosted binaries in a GitHub repository to deploy miners in cloud build and runtime environments.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.