AWS billed user $45,000 after Monero miners hacked his account

SEO Scout founder Johnny Platt fell victim to hackers mining Monero.

\n See more

🎄 Excited to announce I just received my Christmas present from @awscloud!

😱 Horrified to see it’s $45,000 in charges due to some scammer hacking my account + mining Crypto for the last few weeks

⏰ Had no sleep last night. It’s now 23 hrs since my support ticket & no reply.

— Jonny Platt (@jonnyplatt) December 14, 2021

\n\n

Unknown attackers breached his Amazon Web Services (AWS) account and used it for mining over several weeks. As a result, the company billed Platt $45,000.

\n\n

According to findings, the attackers launched a mining script on AWS Lambda. Every three minutes it ran on different Lambda installations and mined cryptocurrency for the maximum allowed 15 minutes. In total, the hackers mined 6 XMR (about $800).

\n\n

Platt is convinced that Amazon could have detected the fraudsters.

\n\n

«The script was an unencrypted plaintext file, and AWS could easily identify in it lines of code used in similar attacks to raise suspicion,» he wrote.

\n\n

A few days later Amazon responded to the user’s complaint and сняла с него все обвинения в виде единовременного исключения.

\n\n

In August, Splunk researchers disclosed a breach of Windows servers inside Amazon Web Services that were used for hidden mining of Monero via the Telegram desktop client.

\n\n

Follow ForkLog’s bitcoin news on our Telegram — news on cryptocurrencies, rates and analytics.