ECS Fargate cryptojacking

Datadog observed an attacker leveraging a compromised IAM user access key to gain initial access to an AWS environment, at which point they immediately began spinning up hundreds of ECS Fargate clusters, within which they created ECS task definitions to launch containers based on 40 malicious public Docker Hub images. Overall, the attacker likely succeeded to run thousands of such containers, each running XMRig for cryptomining purposes. Based on the number of downloads of the Docker images, Datadog estimates that this incident was in fact part of larger campaign that might have targeted anywhere between tens and hundreds of thousands of environments.