AWS EC2 Cryptojacking Case Study: Fixing SSH Misconfigurations and Access Best Practices

Cloud computing has become a critical infrastructure for many enterprises and organizations, providing them with scalable, flexible, and cost-effective solutions. However, with the widespread adoption of cloud environments, threat actors have shifted their targets to the cloud, exploiting cybersecurity weaknesses to conduct various malicious activities—ranging from data theft and cyber espionage to Distributed Denial of Service (DDoS) attacks.

Recently, malicious activities leveraging cloud resources for cryptocurrency mining (cryptojacking) have emerged. Threat actors gain unauthorized access to cloud VMs via brute-force attacks, vulnerability exploitation, or credential theft. Once a host is compromised, attackers indiscriminately hijack your cloud compute power for intensive cryptomining, leading to degraded system performance, surging costs, and even service disruptions.

Case Background

In this case, the client deployed their applications to the cloud to enhance scalability and flexibility, creating auto-scaling cloud VMs to run their workloads. To simplify management, all cloud VMs were configured with identical login credentials. This practice inadvertently opened a backdoor for attackers: after successfully compromising one host using a weak password, the hacker group easily moved laterally to control the entire VM environment. Subsequently, they installed cryptocurrency mining software across multiple hosts, exhausting the VMs' CPU resources for mining operations.

Incident Analysis Process

As the hacker group continuously conducted mining activities within the enterprise cloud environment, system resources were heavily consumed. This not only slowed down other applications and degraded user experience, but also wasted cloud resources, causing cloud service bills to surge. Upon receiving monthly statements, the client noticed a continuous increase in costs over three consecutive months. Detailed review revealed a drastic spike in cloud VM charges compared to historical baselines. The client immediately contacted their Cloud Managed Service Provider (MSP) to raise billing concerns and request a formal investigation.

Because the client's cloud environment had only basic monitoring enabled, the MSP's security architects analyzed telemetry data and detected abnormal CPU spikes on VMs during midnight hours. Deep-dive log analysis revealed a specific process automatically executing at 1:00 AM and terminating at 6:00 AM daily. Furthermore, system logs showed unauthorized IP addresses executing remote commands during these intervals, indicating attacker presence. Upon confirming the process was a cryptomining program, three immediate emergency response actions were taken, followed by discussions on preventive recommendations:

● Disable external SSH access controls

● Rotate all cloud VM login credentials

● Terminate and remove the cryptomining software

Why Cloud Cryptojacking Occurs

Cloud cryptojacking refers to unauthorized execution of mining software on cloud VMs. Because these VMs offer high computing capacity, attackers exploit misconfigurations and software vulnerabilities to hijack these resources, redirecting mining rewards to their private crypto wallets. The primary drivers include:

● High Compute Capacity: Cloud providers deliver elastic and scalable compute resources, which hackers target and hijack for high-throughput mining operations.

● Insufficient Security Posture: A lack of security awareness or prioritizing operational convenience over security leads to compromised VMs—such as using identical credentials across all hosts in this case.

● Readily Available Mining Tools: Numerous free or open-source mining scripts exist online, lowering the technical barrier to entry for attackers.

● Cryptocurrency Price Volatility: Rising cryptocurrency market values increase potential profits, further incentivizing threat actors to execute cryptojacking attacks.

Recommended Access Settings for AWS EC2 Instances

● AWS SSH Security Group Rules: Inbound SSH rules for EC2 must restrict source IP ranges (Custom IP/CIDR) and never be set to Anywhere (0.0.0.0/0), which exposes your instances to remote SSH access from anyone on the Internet (see Figure 1).

Figure 1: AWS SSH Firewall / Security Group Rule Configuration

● Do Not Assign Public IPs to EC2 Instances: Avoid assigning public IP addresses to EC2 instances to reduce the attack surface and public exposure risk (see Figure 2).

Figure 2: EC2 Instance Auto-Assign Public IP Disabled Configuration

● Manage and Access EC2 via AWS Systems Manager (SSM): When managing large-scale EC2 environments, use AWS Systems Manager for secure operational access. Attach an IAM Role with Systems Manager permissions to the EC2 instances and install the SSM Agent to enable centralized, passwordless management (see Figure 3).

Figure 3: Attaching an IAM Role for AWS Systems Manager to an EC2 Instance

How to Prevent and Detect Cloud VM Cryptojacking

How do you safeguard cloud VMs against cryptojacking? In large-scale environments, prevention requires strict system resource monitoring, granular access controls, and routine patch management. Recommended practices include:

● Strong Password Policies: Enforce robust password standards, utilize secrets management tools, and periodically rotate credentials for all cloud resources to mitigate compromise risks.

● Eliminate Credential Reuse: While sharing credentials simplifies administration, a single leak grants attackers total administrative control over all interconnected systems with severe consequences.

● Private IP Topology: Minimize public exposure by disabling public IP addresses on VMs and routing administrative traffic through controlled bastion hosts or secure gateways.

● Cloud-Native Central Management: Leverage native system management tools to centralize identity management, automated vulnerability scanning, and software patch deployment across enterprise fleets.

● Continuous Cloud Monitoring: Deploy real-time telemetry and monitoring across all cloud VMs to proactively detect anomalous resource usage, analyze runtime metrics, and trigger automated threat responses.

Conclusion

Cloud security is a multi-faceted discipline requiring layered defenses to safeguard enterprise assets. Ensuring robust access credential security remains a critical pillar. By enforcing strong authentication, eliminating credential reuse, conducting routine credential rotations, enabling Multi-Factor Authentication (MFA), monitoring cloud environments continuously, and delivering security awareness training, enterprises can significantly mitigate security risks and prevent threat actors from hijacking cloud infrastructure.