TRIPLESTRENGTH: Cloud Account Hijacking and Cryptocurrency Mining via Stolen Credentials (Campaign)
ID: a706022b-6a21-503f-a9b7-e31b1e8bb5c0
STIX ID: report--a706022b-6a21-503f-a9b7-e31b1e8bb5c0
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2025-01-21
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
The report describes TRIPLESTRENGTH, a criminal group that uses credentials and cookies (sourced in part from the Raccoon infostealer) to compromise cloud accounts across providers like Google Cloud, AWS, Linode and others, then abuses billing privileges and creates compute resources for large-scale cryptocurrency mining; Google TIG and Mandiant corroborate active exploitation and affiliate resale of access.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.