Attackers Use Stolen AWS Credentials in Cryptomining Campaign

AWS security teams detected a widespread cryptomining campaign where attackers leveraged compromised AWS IAM credentials to provision EC2 and ECS resources and deploy miners within ~10 minutes. The actors performed permission reconnaissance (GetServiceQuota, DryRun RunInstances), created service-linked and Lambda roles, attached execution policies, and used persistence by setting instance termination protection; AWS published IoCs (malicious Docker image yenik65958/secret, domains asia.rplant.xyz eu.rplant.xyz na.rplant.xyz, instance naming patterns) and recommended IAM hardening, MFA, temporary credentials, and CloudTrail monitoring.