Exposed Training Open the Door for Crypto-Mining in Fortune 500 Cloud Environments

Pentera Labs found nearly 2,000 publicly exposed, intentionally vulnerable training/demo applications—about 60% on customer-managed AWS, Azure, or GCP—often connected to privileged cloud identities, creating paths for lateral movement beyond the host. Approximately 20% of instances contained evidence of active compromise (e.g., cryptomining, webshells, persistence), with exposures observed even in Fortune 500 environments and major cybersecurity vendors. The research underscores that mislabeled “training/test” systems, weak defaults, and excessive permissions turn these apps into real attack entry points and should be governed by the same security and lifecycle controls as production assets.