Amazon: Ongoing cryptomining campaign uses hacked AWS accounts

Amazon GuardDuty identified an ongoing cryptomining campaign that used compromised IAM credentials to deploy a Docker image (yenik65958/secret containing SBRMiner-MULTI) to EC2 and ECS resources. The attacker rapidly launched heavy-resource ECS tasks and EC2 auto-scaling groups and used ModifyInstanceAttribute to disable API termination for persistence; Amazon removed the malicious image and alerted affected customers to rotate credentials.