Google warns crypto miners are hacking cloud accounts

Cryptocurrency miners are using hacked Google Cloud accounts for computationally-intensive mining purposes, Google has warned.

The search giant’s cybersecurity team provided details of the security breach in a report published Wednesday. The so-called “Threat Horizons” report aims to provide intelligence that allows organizations to keep their cloud environments secure.

“Malicious actors were observed performing cryptocurrency mining within compromised Cloud instances,” Google wrote in an executive summary of the report.

Cryptocurrency mining is a for-profit activity that often requires large amounts of computing power, which Google Cloud customers can access at a cost. Google Cloud is a remote storage platform where customers can keep data and files off-site.

Google said 86% of 50 recently compromised Google Cloud accounts were used to perform cryptocurrency mining. In the majority of the breaches, cryptocurrency mining software was downloaded within 22 seconds of the account being compromised, Google said.

Around 10% of the compromised accounts were also used to conduct scans of other publicly available resources on the internet to identify vulnerable systems, while 8% of instances were used to attack other targets.

Bitcoin, the world’s most popular cryptocurrency, has been criticized for being too energy intensive. Bitcoin mining uses more energy than some entire countries. In May, police raided a suspected cannabis farm to find it was in fact an illegal bitcoin mine.

“The cloud threat landscape in 2021 was more complex than just rogue cryptocurrency miners, of course,” wrote Bob Mechler, director of the office of the chief information security officer at Google Cloud, and Seth Rosenblatt, security editor at Google Cloud, in a blog post.

They said Google researchers also exposed a phishing attack by Russian group APT28/Fancy Bear at the end of September, adding that Google blocked the attack.

Google researchers also identified a North Korean government-backed threat group which posed as Samsung recruiters to send malicious attachments to employees at several South Korean anti-malware cybersecurity companies, they added.