An attacker used a planted AWS key five minutes after it appeared on GitHub

The test environment was the Prisma Cloud security team's HoneyCloud project, a deliberately compromisable cloud environment built to monitor whatever malicious operations arrive in it ^[12]. Each exposure needed a target with no leak history and a key carrying more privilege than it should. The team generated the accounts and the credentials automatically for each run ^[10]. The five-minute clock therefore ran on a fresh high-privilege credential in an account the scanner had no reason to distrust ^[3].

Unit 42's account of what the intruder did next describes an account with AWS's own protection taken off ^[2]. With the quarantine policy applied, the report says, the actor's ability to operate was limited ^[4]. Detection does not appear to depend on the policy at all. The policy constrains what the credential can launch once found, and the EC2 fleet Unit 42 watched ran in an account where nothing constrained it ^[5].

The scale figure comes from the other end of the operation. Between Aug. 30 and Oct. 6, 2023, Unit 42 counted 474 unique miners in the cryptojacking pool that were potentially actor-controlled EC2 instances ^[6]. That window covers 38 calendar days, so roughly 12 miners a day appeared in the researchers' view of the pool ^[15]. Those are instances. One compromised account can start many of them. The actors mined Monero, and Unit 42 says it cannot track the wallet to obtain exact figures for what the campaign earned ^[7].

Five minutes is the fastest observed path. The executive summary gives the interval and does not say how many credentials the team planted or how many were collected ^[16]. The report also appears twice in the material, once as a downloadable PDF under a different headline, and the executive summary is identical ^[14].

The frequency estimate sits in a separate Unit 42 document. Its Cloud Threat Report Volume 7 says 83% of organizations expose hard-coded credentials within production code repositories ^[11]. A hard-coded credential in a repository and a credential published to a public GitHub repository are different conditions, and the cryptojacking report keeps the two numbers separate. The population of secrets sitting in source control is large, and the collection window for any one of them that crosses into public view is short ^[3][8].

Unit 42 closes on the Shared Responsibility Model, and the division it draws is the operational one here. Configurations, patching, maintenance and security monitoring for cloud applications, IAM policies and the resources they can reach belong to the customer ^[13].