The Dark Side of Cloud Computing: How Threat Actors Abuse Millions of Dollars of Cloud Compute
summary
Threat actors compromise admin credentials via password spray, credential dumps or phishing, escalate with Elevate access to gain Azure RBAC owner rights, then use change directory plus a guest invite to transfer subscriptions into attacker-controlled tenants so victim logs stop. They request quota raises, spawn thousands of GPU VMs / scale sets and Azure ML jobs (targeting A100‑class GPUs) and run crypto mining, generating average bills around $300,000 while attackers earn only a few thousand; detect via control‑plane and Entra ID logs, block with MFA and least privilege.
AI-written summary · about
chapters (13)
- 0:00Cloud compute abuse threats
- 1:36Recent cloud abuse incidents
- 3:04Azure subscriptions background
- 5:28Subscription hijacking
- 7:19Attack flow to hijack
- 9:07Subscription hijacking methods
- 12:01Compromising admin credentials
- 15:29Scaling compute abuse
- 19:23Attack chain recap
- 20:48Detecting cloud abuse
- 22:35Mitigation strategies
- 22:58Key takeaways
- 23:41Q&A
related talks
16mLessons from the SOC: Analyzing and remediating cloud attack paths
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
56mHack the Cloud Hack the Company: the Cloud Impact on Enterprise Security
57mCloud’s Dirty Little Secret: It Was Misconfigs All Along
27mAnatomy of an AWS Account Cryptojack
36mCloud Hacking Scenarios