Unit 42 Cloud Threat Report, Volume 7: From Misconfigured Firewall to Cryptojacking Botnet

When your organization is the victim of a data breach, the knee-jerk response is: “How did this happen?” 

Based on a real-life attack scenario observed by our researchers, this infographic shows you exactly how.

Observed by Unit 42® researchers “in the wild,” this visual breakdown shows how an anonymous organization became the victim of cryptojacking. In this scenario, the threat actor exploited a misconfigured firewall to deploy hundreds of VM instances to perform large-scale cryptomining and botnet operations on the organization’s network. 

We break down the attack path into Tactics, Techniques and Procedures (TTPs), following MITRE’s Cloud ATT&CK Matrix. The order of the tactics also corresponds to the path of the attack as observed by our researchers.