Cryptojackers spread their nets to capture more than just EC2

As cloud native computing continues to gain popularity, so does the risk posed by criminals seeking to exploit the unwary. One newly spotted method targets services on the AWS platform, but not necessarily the ones you might think. Researchers from the Sysdig Threat Research Team (TRT) have uncovered a cryptojacking operation …

[Rikki Tikki]

Dear El Reg, it's often good to define abbreviations when they are first used - seeing "EC2" in the title, and here's this poor expatriate pom thinking that evil hackers are targeting that dear little Old Lady of Threadneedle Street. We're not all Americans, you know.

[Anonymous Coward]

@RIkki Tikki

Although I do understand your point, "EC2" is not so much of an abbreviation (initialism/alphabetism/acronym) as the name of the AWS (see what I did there?) product.

You wouldn't expect "IBM" to be defined in full would you as that is the name of the company. And quite honesty if you don't know what EC2 is, you've got even less chance of knowing what Amplify or Sagemaker or probably 95% of the stupid names Amazon (AWS) give their products!

[Anonymous Coward]

Russian Linux images abusing AWS

How does AMBERSQUID initially infect AWS services?

Sysdig: “Containers are great, as they allow developers to quickly get infrastructure up and running. However, threat actors can hide malicious code inside of these pre-built containers. If one wrong image is loaded, the entire environment can be compromised.”

DOH!

Sysdig: “It is easy to think threat actors are all about profit or espionage. The Russian invasion of Ukraine shows that geopolitical events can prompt a shift from profit making to participating in conflicts through cyber attacks.”

Insert anti-commie propaganda!