Case study - A cryptominer traced in eight hours
An admin key had been in a public repository for eight months.
- System
- Cloud incident response
- When
- Previous engagement
- Service
- Incident response
Overview
A cryptominer was running in a company's cloud account.
What we found
The root cause was found in eight hours: an admin access key had sat in a public repository for eight months. We found and removed three persistence mechanisms.
Result
The environment was rebuilt from clean images within 48 hours with no downtime.
What it touched
- Incident response
- Cloud
- Secrets
- To root cause
- 8 h
- Persistence mechanisms removed
- 3
- Clean rebuild, no downtime
- 48 h