@k3ym0
@da_667

* Cries in DoH-allowed-networks *

@Viss
This is pretty similar to what they actually do. They're a little more sneaky about it to make reverting difficult for victims.

The actor gets admin on a victim cloud account, then spin up an account they control. They set up cross account sharing from the victim account (AWS RAM), and then deploy the cryptomining on the account they control using victim compute.

The only thing victim sees is the RAM enablement logs, if they're monitoring at all, and compute charges, but none of the actual compute instances.

@ftg
@f4grx @wdormann maybe that's all it does and they just don't document it 🤷

For $5 they probably just bundling FOSS

@da_667
It's not great to do late night ones, but better than doing none!

Well done