Google Cloud has shared that malicious actors had recently compromised 50 Google Cloud Platform (GCP) instances, a majority (86%) of which were used for cryptocurrency mining.
Interestingly, Google notes that an analysis of the compromised cloud instances that were used for illicit mining revealed that in 58% of situations the cryptocurrency mining software was downloaded to the system within 22 seconds of being compromised
“This suggests that the initial attacks and subsequent downloads were scripted events not requiring human intervention. The ability to manually intervene in these situations to prevent exploitation is nearly impossible. The best defense would be to not deploy a vulnerable system or have automated response mechanisms,” shares Google Cloud.
Given that most of the compromised instances were used for cryptocurrency mining rather than exfiltration of data, Google analysts fathom that the attackers scanned a range of Google Cloud IP addresses, rather than targeting particular customers.
GCP attacks
The details are part of the first issue of Threat Horizons report produced after collating intel from the Google Threat Analysis Group (TAG), Google Cloud Security and Trust Center, and several other internal teams at Google.
The search engine giant claims the objective of the report is to provide actionable intelligence to help organizations ensure that their cloud environments remain protected against ever-evolving threats.
In addition to cryptoming, the report also revealed that 10% of the compromised Cloud instances were used to conduct scans of other publicly available resources on the Internet in order to identify vulnerable systems, and 8% of instances were used to attack other targets.
Protect your computers with these best antivirus software, and cleanse them with these best malware removal software
