Resource-Hijacking

The deletion of Anthropic extra-usage spend limits acts as a precursor for resource hijacking and financial abuse, allowing adversaries with compromised credentials to conduct large-scale, unrestricted API consumption.

This detection capability monitors for unauthorized resource hijacking, such as cryptomining or exploit payload execution, by identifying new processes exhibiting sustained CPU usage above 90 percent.

Crypto mining malware, often deployed by various threat actors, connects to designated mining pools to perform unauthorized cryptocurrency mining, leading to significant system performance degradation and illicit resource consumption.

Adversaries, after compromising AWS credentials, deploy cryptomining operations on Amazon ECS and AWS Fargate by registering task definitions with public high-CPU container images and then launching them, leading to unauthorized resource consumption and increased cloud costs.