Attackers use leaked cloud credentials or exposed workloads to launch large compute instances or containers that mine cryptocurrency, generating heavy bills and often signaling broader account compromise.
Immediate Response
1Disable the compromised access keys and terminate attacker-created resources.
2Snapshot affected instances for forensics before termination where possible.
3Review CloudTrail or equivalent logs for persistence such as new users, roles, or Lambda functions.
4Open a case with the cloud provider for billing review.
