3 ms·

Any idea what they were doing with them? Mining bitcoins? Hosting CnC for a botnet?

• fpgaminer 11y ago
  It's always Bitcoin mining. The attacker spins up a bunch of GPU EC2 instances and mines as long as they can. I don't think the profit ends up being very large (those GPU instances put out a puny amount of hashing power compared to modern mining ASICs)...
  • icelancer 11y ago
    ROI for BTC mining on standard AWS pricing is about -90%. So attackers get 10% free BTC on spend.
    • tajen 11y ago
      So, out of $11k, they make $1k. That's the kind of money they need to make between once and three times a month minimum depending on where they live. Doesn't Amazon notice patterns in terms of source, scripts which are uploaded and scaling profile: Who uses 2 medium instances for a year then spins off 2,000 in 20 minutes?
      • icelancer 11y ago
        Certainly there's a pattern there, but it's not THAT far away from people who intermittantly scale stuff for short bursts of huge processing. False positives in those cases for people that really intended to spend $10-50k in a short time might mean a HUGE loss of revenue and/or incurred customer support and service costs.
  • Taek 11y ago
    It's not that bad. The smart attackers don't do Bitcoin mining, they do altcoin mining, and they pick altcoins that don't have ASICs out. Then they are competing with other GPUs. I'm not sure what the profit is, but I'd guess it's between 30% and 70% of the bill incurred.