MITRE ATT&CK T1496 Resource Hijacking: Detecting and Limiting Damage

Resource hijacking turns your compute, bandwidth, messaging quota or AI model access into someone else's revenue, and you find out from the bill. MITRE ATT&CK T1496 Resource Hijacking is an Impact (TA0040) technique on Windows, Linux, macOS, IaaS, Containers and SaaS: adversaries use co-opted resources for resource-intensive tasks, which may affect availability. In ATT&CK v20 it has four sub-techniques: compute hijacking (cryptomining), bandwidth hijacking (proxyjacking, botnets, scanning), SMS pumping, and cloud service hijacking (mass email and SMS, LLMjacking). In cloud environments the damage is fast: AWS reported miners running within 10 minutes of initial access in a 2025 campaign. This guide gives the ATT&CK technique view: sub-techniques, cases, the v20 detection analytics, cost-limiting controls and testing. It is for SOC, cloud security and FinOps teams. For the broader topic, see the Cryptojacking Guide.

Key takeaways

• It is an identity problem first. Most cloud cases start with stolen access keys, compromised admin accounts or abused application identities, not malware on a host.
• Speed decides the cost. Detection measured in days lets the bill grow; Microsoft reported victims of one OAuth abuse actor paying between 10,000 and 1.5 million US dollars in compute fees.
• Revoking the key is not the end. Attackers add IAM users, application secrets, termination protection and public function URLs so the mining survives the first response.
• Four sub-techniques, four log worlds. Host and container telemetry for compute and bandwidth, cloud control plane and billing for IaaS, application logs for SMS pumping and SaaS messaging abuse.
• ATT&CK maps one mitigation. M1013 Application Developer Guidance for SMS pumping (CAPTCHA on SMS-sending forms). The rest of the defence is credential hygiene, quotas, budgets and monitoring.

The four sub-techniques

Each sub-technique has its own ATT&CK entry and deserves its own detection plan; this page covers the shared technique view. Two topics have deeper NHI Mgmt Group guides: the LLMjacking Guide for stolen AI service credentials and the Phone Number Fraud guide for SMS pumping. The AI-side mirror in MITRE ATLAS is AML.T0034 Cost Harvesting.

How adversaries have used it

Procedure examples in ATT&CK v20

ATT&CK lists groups and software that deploy miners, among them Rocke (G0106), TeamTNT (G0139), Blue Mockingbird (G0108), APT41 (G0096), Kinsing (S0599), Skidmap (S0468, a kernel-mode rootkit used for mining) and Hildegard (S0601). APT41 shows that state-linked groups also mine opportunistically. ATT&CK also records the ShadowRay campaign (C0045), in which actors used GPUs on compromised nodes for mining.

Cases on NHI Mgmt Group breach pages

• Compromised IAM credentials, AWS, 2025: AWS reported a campaign from 2 November 2025 using compromised IAM credentials with admin-like privileges. The actor checked service quotas and tested permissions with DryRun calls, then created dozens of ECS clusters and 14 auto scaling groups able to scale to 999 instances each, including GPU types. Miners ran within 10 minutes. Persistence included termination protection on instances, a Lambda function with an unauthenticated public URL and a new IAM user with SES permissions. GuardDuty findings included Impact:Runtime/CryptoMinerExecuted. See Amazon AWS Crypto-Mining Campaign 2025.
• Application identities, Azure, 2023: Microsoft reported in December 2023 that Storm-1283 used a compromised account with an owner role on a subscription to register an OAuth application, add secrets, grant it Contributor on the subscription and deploy mining VMs named to look routine. Microsoft put victims' compute fees at 10,000 to 1.5 million US dollars. See Storm-1283 OAuth Apps Abuse 2023.
• Exposed AI compute, 2024: Oligo disclosed in March 2024 that attackers submitted jobs to Ray clusters whose Jobs API had no authentication, ran XMRig, NBMiner and Zephyr miners on GPUs and took cloud, AI service and database credentials. See ShadowRay 2024.
• Exposed container management, 2018: at Tesla, an unprotected Kubernetes console led to AWS credentials in a pod and mining that used a private pool, CloudFlare and low CPU usage to stay quiet. See Tesla Kubernetes Cryptojacking 2018.

Where identity fits

In the cloud cases above, the resource was hijacked through a non-human identity or an over-privileged account: long-lived access keys with admin rights, an OAuth application granted Contributor, credentials stored inside a pod. Three controls cut most of the risk. Remove long-lived keys in favour of short-lived role credentials and workload identity. Keep application and automation identities away from subscription-wide Contributor or administrator roles that allow creating compute. Alert on new credentials added to existing applications and on new IAM users and access keys, which ATT&CK tracks as T1098.001 Additional Cloud Credentials. For AI services, provider API keys are the hijacked resource itself. See the AWS Access Keys Security Guide and the Cloud Access Key Leak Playbook.

What to detect and where

ATT&CK v20 detection strategy DET0267 covers the technique across six platforms, with a separate strategy per sub-technique (DET0540 compute, DET0028 bandwidth, DET0156 SMS pumping, DET0147 cloud service hijacking).

NHI Mgmt Group recommends prioritising control plane signals over host signals in the cloud, because they fire before the miner starts:

• Quota reconnaissance and dry runs: service quota reads and DryRun permission tests by an identity that does not normally provision compute, which preceded the 2025 AWS campaign.
• Burst provisioning: instance, auto scaling group, cluster or GPU creation outside change windows or by identities other than your IaC pipeline. Pair with MITRE ATT&CK T1578 Modify Cloud Compute Infrastructure.
• Unusual regions: any compute in regions you do not use. See MITRE ATT&CK T1535 Unused/Unsupported Cloud Regions.
• Persistence markers: termination protection enabled on new instances, public unauthenticated function URLs, quota increase requests.
• Managed detections: AWS GuardDuty documents finding types including CryptoCurrency:EC2/BitcoinTool.B and CryptoCurrency:EC2/BitcoinTool.B!DNS for instances querying IPs or domains associated with cryptocurrency activity, and Impact:EC2/BitcoinDomainRequest.Reputation. See the Amazon GuardDuty Guide.
• Cost anomalies: billing anomaly alerts are a detection control of last resort, but sometimes the only one for SaaS and AI services. Route them to the SOC, not only to finance.

Mining pool lists and domain feeds age fast and attackers use private pools and proxies, as at Tesla. Treat DestinationIPList-style matching as a bonus and rely on behaviour: sustained CPU from an unexpected binary or image, and new compute created by unexpected identities.

Mitigations and cost-limiting controls

ATT&CK v20 maps one mitigation in this technique family: M1013 Application Developer Guidance on T1496.003, advising CAPTCHA protection on forms that send SMS. The following are NHI Mgmt Group recommendations drawn from the cases and the vendor guidance cited on the breach pages:

Response priorities

1. Stop the spend: scale down auto scaling groups, stop instances and tasks; remove termination protection first where it was set.
2. Cut the identity: disable the compromised keys, sessions or application secrets.
3. Hunt persistence: new IAM users, roles, access keys, application credentials, function URLs, launch templates and resources in unused regions. AWS's lesson from the 2025 campaign was that revoking the leaked key alone was not enough.
4. Find the entry point: where the credential leaked, or which exposed API was used.
5. Contact the provider about billing; document timelines and evidence.

Full procedures are in the Cryptojacking Incident Response Playbook and the LLMjacking Response Playbook.

Implementation sequence

1. Turn on the logs: cloud audit logs in all regions, flow logs, managed threat detection, container runtime telemetry and EDR on servers.
2. Set budgets and anomaly alerts per account and subscription and route them to the SOC.
3. Apply region and service restrictions in monitor or audit mode first where your platform supports it, check for breakage for two weeks, then enforce. Rollback is removing the policy.
4. Remove long-lived admin keys and reduce application identities' rights to create compute.
5. Deploy control plane detections for burst provisioning, unusual regions and persistence markers, tuned against your IaC pipeline identities.
6. Add host and container analytics for sustained CPU from unexpected binaries and images.

Small teams should start with budgets, region restrictions and managed threat detection, which give most of the coverage for little effort. Large estates should manage the allow list of provisioning identities as code and test detections on a schedule.

How to test

• Control plane drill: in a sandbox account, have a non-pipeline test identity create an instance in an unused region and confirm both the policy block and the alert.
• Managed detection check: use the provider's documented sample findings feature, where available, to confirm cryptocurrency findings reach the SOC queue.
• Host behaviour: run a benign CPU stress process from an unusual path on a test server and confirm the sustained-CPU analytic fires and is triaged as expected.
• Response timing: time from first malicious API call to spend stopped in a tabletop exercise based on the 2025 AWS case.

Metrics

• Mean time from unauthorised compute creation to containment.
• Number of long-lived access keys with rights to create compute.
• Percentage of accounts and subscriptions with budgets and anomaly alerts routed to the SOC.
• Percentage of regions denied by policy that are not in use.
• Count of exposed, unauthenticated management or job APIs found by scanning (target zero).

Common failure patterns

• Revoking one key and stopping: the attacker's new users, app secrets and protected instances keep running.
• Billing alerts sent only to finance: the signal arrives, but nobody in security sees it for weeks.
• Applications with subscription Contributor: Storm-1283 granted itself exactly this through a new OAuth app.
• Exposed AI and container compute: ShadowRay and Tesla both began with an unauthenticated management interface.
• Relying on mining pool block lists: private pools and proxies avoid them.

Framework mapping

Practitioner checklist

• Budgets and cost anomaly alerts exist for every cloud account and AI service, routed to the SOC.
• Unused regions and unneeded instance families are denied by policy.
• No long-lived admin access keys; workloads use short-lived role credentials.
• Application identities cannot create compute at subscription or account scope.
• Alerts exist for new IAM users, access keys and application secrets.
• Managed threat detection is on in every region, with cryptocurrency findings triaged.
• No unauthenticated Docker, Kubernetes, Ray or similar management APIs are exposed.
• SMS-sending forms have bot protection and rate limits.
• The response runbook covers persistence clean-up, not only key revocation.

Standards and references

• MITRE ATT&CK: T1496 Resource Hijacking
• MITRE ATT&CK: C0045 ShadowRay
• MITRE ATT&CK: M1013 Application Developer Guidance
• AWS: GuardDuty EC2 finding types
• MITRE ATLAS: AML.T0034 Cost Harvesting
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: ATT&CK Impact Tactic Guide, Denial-of-Wallet and AI Agent Cost Runaway Guide, MITRE ATT&CK T1098 Account Manipulation Guide and AWS Lambda Security Guide.