They Hacked Thousands of Cloud Accounts Then Sent Us Weird GIFs

The presentation discusses the importance of basic security measures in cloud computing, particularly in developer and test environments, and highlights the vulnerability of AWS credentials to malware attacks.

• Basic security measures are crucial in cloud computing
• Developer and test environments are often overlooked and vulnerable to attacks
• AWS credentials are susceptible to malware attacks
• Team TnT is a group of attackers who use AWS credit to spread malware
• Hackers may respond to blog posts about their activities

The presenter discovered a malware attack on an AWS server that stole AWS credentials and could potentially download files and control instances. The attackers, Team TnT, had their own official website and even left messages on the server warning against further exploration. The presenter's blog post about the attack gained attention for its coverage of the unique AWS credit method used by the attackers. The attackers even responded to the post with a somewhat polite message expressing frustration with the publicity.

As organizations migrate their computing resources to cloud and container environments, attackers are taking notice -- and following. In August 2020, we discovered the first crypto-mining worm stealing AWS credentials. The attackers are now well known for their cloud-specific attacks. Recently, we discovered they had expanded their toolkit to both steal more credentials from compromised cloud systems and deploy some innovative techniques to exploit containerised Kubernetes systems and more cloud providers.In this session, we will discuss the cloud-specific nature of the real-world attacks we've seen, sharing insights and details that have not yet been published. We will walk attendees through the overall attack group operation and their most recent innovations to be on the lookout for. Finally, we will highlight the attack group's recent movements, operational security mistakes and provide a behind the scenes look at how they manage compromised cloud accounts.