Hackers Are Attacking Cloud Accounts to Mine Cryptocurrencies, Google Says

Compromised accounts were also used to find new targets and host malware and phishing scams.

AccessTimeIconNov 26, 2021 at 7:26 p.m. UTC
Updated May 11, 2023 at 4:04 p.m. UTC

Compromised Google Cloud accounts were used by 86% of “malicious actors” to mine cryptocurrencies, according to a new report.

Some 50 Google Cloud Platforms, or GCP, customer instances were compromised, according to the report from Google. Crypto mining typically consumes large amounts of computing resources and storage space, Google’s cybersecurity action team wrote in the report. The remainder of the hacking activities included phishing scams and ransomware.

Exploits remain common in the digital assets sector, especially with large amounts of capital flowing into the industry. In May a hacking group installed crypto mining malware into a company server through a weakness in Salt, a popular infrastructure tool used by the likes of International Business Machines, LinkedIn and eBay.

Moreover, in August, more than $600 million was stolen in one of the biggest crypto heists to date, exploiting a vulnerability in the Poly Network, although some of the amount stolen was returned. In 2014, Mt. Gox, the world’s largest bitcoin exchange at the time, filed for bankruptcy after hackers stole $460 million worth of crypto.

Poor security practices

Most of the attacks on the GCPs are primarily due to poor security practices by the customers, including the use of weak or no passwords. “Malicious actors gained access to the Google Cloud instances by taking advantage of poor customer security practices or vulnerable third-party software in nearly 75% of all cases,” the report said.

In the cases of hackers using accounts to mine cryptocurrencies, mining software was installed within 22 seconds of the attack, making manual interventions ineffective in preventing such attacks. “The best defense would be to not deploy a vulnerable system or have automated response mechanisms,” the report recommended.

To prevent such attacks, the team recommended several different security approaches, including scanning for vulnerabilities, using two-factor authentication and implementing Google’s Work Safer product for security.

“Given these specific observations and general threats, organizations that put emphasis on secure implementation, monitoring and ongoing assurance will be more successful in mitigating these threats or at the very least reduce their overall impact,” the authors concluded.

CORRECTION (Dec. 1, 17:47 UTC): Corrects to note that 50 Google Cloud Platform customer instances were compromised, not hacked, in second paragraph.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

CoinDesk - Unknown

Aoyon Ashraf is managing editor with more than a decade of experience in covering equity markets

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.