Topic starter
24/06/2026 11:28 pm
TL;DR: A cloud cryptomining campaign is abusing compromised credentials to make privileged AWS API calls, while detection only spots the activity after it begins, according to Sonrai Security. The real gap is not visibility but standing permission to execute high-risk actions that most identities never need.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Preventing This Week's AWS Cryptomining Attacks: Why Detection Fails and Permissions Matter”.
By the numbers:
- 92% of identities granted these privileged permissions never use them, according to Sonrai Security.
Key questions
Q: What breaks when AWS identities can call privileged compute APIs by default?
A: Standing permission turns routine credentials into infrastructure creation tools.
Q: Why do privileged AWS permissions increase cryptomining risk so much?
A: Because cryptomining only needs enough access to provision compute and keep it running.
Q: How do security teams know whether cloud access policy is actually working?
A: They should test whether policy decisions are traceable from discovery to approval to revocation.
Practitioner guidance
- Block high-risk AWS API permissions by default Remove standing access to actions such as create launch templates, register task definitions, create access keys, and modify termination settings unless a role has a proven need for them.
- Use usage history to gate privilege Review whether privileged permissions have actually been used in the last 90 days and strip effective access when there is no operational justification.
- Separate alerting from prevention Keep detection for investigation, but place preventative controls in front of compute creation, identity creation, and persistence APIs so abuse fails on first use.
Bottom line: The article shows that AWS cryptomining succeeds when compromised identities can still invoke privileged cloud actions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:22 am
Cloud cryptomining is really a privileged permission problem: the attacker does not need new malware when legitimate AWS APIs can create the infrastructure for them. Detection remains reactive because the decisive control is whether the identity can execute a high-risk action at all. The practitioner conclusion is simple: prevention must sit on the permission path, not only in the alert queue.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when an AWS account still needs occasional privileged access?
A: Use time-bound, on-demand access for the specific action, then remove the privilege when the task ends. The objective is to preserve legitimate administration without leaving standing access in place for attackers to reuse. That makes cryptomining and persistence attempts much harder to execute with stolen credentials.
👉 Read our full editorial: AWS cryptomining shows why cloud permissions need prevention