Rami McCarthy

> Of 50 recently compromised GCP instances, 86% of the compromised Google Cloud instances were used to perform cryptocurrency mining, a cloud resource-intensive for-profit activity

https://services.google.com/fh/files/blogs/gcat_threathorizons_full_july2022.pdf

I'm going to leave this open, but not add I think "opportunistically grabs AWS credentials" doesn't quite rise to the level of tracking -- versus "targets AWS hosted infrastructure", if...