The Ukrainian National Police and Europol have announced the arrest of an individual believed to be involved in a $2 million cryptojacking operation.
According to Europol, the suspect, a 29-year-old individual residing in Mykolaiv, Ukraine, is likely the mastermind behind a scheme targeting user accounts at a cloud services provider.
As part of the operation, which started in 2021, the miscreant targeted the servers of one of the largest ecommerce companies, hacking more than 1,500 user accounts in automated password brute-forcing attacks, the Ukrainian authorities announced.
The attacker then gained management access and infected the service with cryptocurrency mining malware.
Over a period of the widespread cryptojacking operation, the individual is believed to have mined more than $2 million in cryptocurrency.
The Ukrainian police conducted searches at three properties and seized computer equipment, SIM cards, bank cards, and other evidence of illegal activity.
Authorities are currently working on identifying the individual's potential accomplices and are investigating his possible affiliation with pro-Russian hacking groups.
Threat actors are known to target cloud servers for cryptojacking due to the high computing power these environments provide.
In July last year, Aqua Security and SentinelOne analyzed a TeamTNT cryptojacking campaign that expanded from Amazon Web Services to Microsoft Azure and Google Cloud Platform services.
In October, Palo Alto Networks revealed that, for two years, a threat actor had been harvesting IAM credentials from public GitHub repositories within minutes of exposure, using them to set up AWS Elastic Compute instances for illicit crypto-mining.
This Cyber News was published on www.securityweek.com. Publication date: Mon, 15 Jan 2024 16:13:04 +0000