The Ukrainian National Police and Europol have announced the arrest of an individual believed to be involved in a $2 million cryptojacking operation.
According to Europol, the suspect, a 29-year-old individual residing in Mykolaiv, Ukraine, is likely the mastermind behind a scheme targeting user accounts at a cloud services provider.
“A cloud provider approached Europol back in January 2023 with information regarding compromised cloud user accounts of theirs. Europol shared this information with the Ukrainian authorities, who subsequently opened an investigation,” the European agency for law enforcement said on Friday.
As part of the operation, which started in 2021, the miscreant targeted the servers of one of the largest ecommerce companies, hacking more than 1,500 user accounts in automated password brute-forcing attacks, the Ukrainian authorities announced.
The attacker then gained management access and infected the service with cryptocurrency mining malware.
“The hacker created more than one million virtual computers to run the malware,” the Ukrainian authorities said.
Over a period of the widespread cryptojacking operation, the individual is believed to have mined more than $2 million (€1.8 million) in cryptocurrency.
The Ukrainian police conducted searches at three properties and seized computer equipment, SIM cards, bank cards, and other evidence of illegal activity.
Authorities are currently working on identifying the individual’s potential accomplices and are investigating his possible affiliation with pro-Russian hacking groups.
Threat actors are known to target cloud servers for cryptojacking due to the high computing power these environments provide.
In July last year, Aqua Security and SentinelOne analyzed a TeamTNT cryptojacking campaign that expanded from Amazon Web Services (AWS) to Microsoft Azure and Google Cloud Platform (GCP) services.
In October, Palo Alto Networks revealed that, for two years, a threat actor had been harvesting IAM credentials from public GitHub repositories within minutes of exposure, using them to set up AWS Elastic Compute (EC2) instances for illicit crypto-mining.
“By stealing cloud resources to mine cryptocurrencies, the criminals can avoid paying the necessary servers and power, the cost of which typically outweighs the profits. The compromised account holders are left with huge cloud bills,” Europol notes.
Related: ‘Looney Tunables’ Glibc Vulnerability Exploited in Cloud Attacks
Related: Dero, Monero Cryptojackers Fighting for Same Kubernetes Clusters
Related: Nigerian Arrested, Charged in $7.5 Million BEC Scheme Targeting US Charities
