Greg Hunkins on X: "Two days ago hackers broke into an old GCP project of ours and launched a bitcoin mining operation.
It cost us approximately $5K in the hours it was active.
Upon alert, I immediately turned to Fable. And immediately I was blocked due to “suspicious activity” https://t.co/afUrEQ6Sj4" / X<br>Post
Log inSign up
Post
Greg Hunkins
@greghunkins
Two days ago hackers broke into an old GCP project of ours and launched a bitcoin mining operation.
It cost us approximately $5K in the hours it was active.
Upon alert, I immediately turned to Fable. And immediately I was blocked due to “suspicious activity”
span:not(:empty)~span:not(:empty)]:before:content-['·'] [&>span:not(:empty)~span:not(:empty)]:before:px-1 [&>span:not(:empty)~span:not(:empty)]:before:shrink-0">8:14 PM · Aug 3, 202628Views
span:not(:empty)~span:not(:empty)]:before:content-['·'] [&>span:not(:empty)~span:not(:empty)]:before:px-1 [&>span:not(:empty)~span:not(:empty)]:before:shrink-0 min-w-0 overflow-hidden">Greg Hunkins
@greghunkins
11m
This is the issue with naive global guardrails.
The defenders are left with twigs and mud while the attackers run Dark Mythos Unleashed 9000.
We need to figure out a better way.
svg]:size-5 text-body hover:bg-mix-current hover:bg-mix-amount-10 active:bg-mix-current active:bg-mix-amount-15 focus-visible:bg-mix-current focus-visible:bg-mix-amount-10 outline-current -m-2 shrink-0 cursor-pointer border-transparent p-0 text-body size-9 [&>svg]:size-[1.25em] [&>[data-engagement-icon]]:size-[1.25em] group-hover:bg-mix-current group-hover:bg-mix-amount-10" aria-label="View count" type="button" data-state="closed" href="/greghunkins/status/2084372242977231042/quotes">7
span:not(:empty)~span:not(:empty)]:before:content-['·'] [&>span:not(:empty)~span:not(:empty)]:before:px-1 [&>span:not(:empty)~span:not(:empty)]:before:shrink-0 min-w-0 overflow-hidden">Greg Hunkins
@greghunkins
11m
The exact timeline of events (all times UTC)
Jul 31, 19:51 — Initial unauthorized access. First service account key minted from a Brazilian IP block. No prior legitimate use of that credential from that source.
Jul 31, 21:03–23:45 — Privilege escalation & persistence.
Jul 31, Show more
svg]:size-5 text-body hover:bg-mix-current hover:bg-mix-amount-10 active:bg-mix-current active:bg-mix-amount-15 focus-visible:bg-mix-current focus-visible:bg-mix-amount-10 outline-current -m-2 shrink-0 cursor-pointer border-transparent p-0 text-body size-9 [&>svg]:size-[1.25em] [&>[data-engagement-icon]]:size-[1.25em] group-hover:bg-mix-current group-hover:bg-mix-amount-10" aria-label="View count" type="button" data-state="closed" href="/greghunkins/status/2084372245108105333/quotes">12
span:not(:empty)~span:not(:empty)]:before:content-['·'] [&>span:not(:empty)~span:not(:empty)]:before:px-1 [&>span:not(:empty)~span:not(:empty)]:before:shrink-0 min-w-0 overflow-hidden">Greg Hunkins
@greghunkins
11m
The intrusion occurred in an isolated VPC entirely separate from our current production. Entry was via a leaked service account key — a long-lived key on the default Compute Engine service account, originally created in 2020 with no expiry.
No user account was compromised: every Show more
svg]:size-5 text-body hover:bg-mix-current hover:bg-mix-amount-10 active:bg-mix-current active:bg-mix-amount-15 focus-visible:bg-mix-current focus-visible:bg-mix-amount-10 outline-current -m-2 shrink-0 cursor-pointer border-transparent p-0 text-body size-9 [&>svg]:size-[1.25em] [&>[data-engagement-icon]]:size-[1.25em] group-hover:bg-mix-current group-hover:bg-mix-amount-10" aria-label="View count" type="button" data-state="closed" href="/greghunkins/status/2084372247079186599/quotes">8
span:not(:empty)~span:not(:empty)]:before:content-['·'] [&>span:not(:empty)~span:not(:empty)]:before:px-1 [&>span:not(:empty)~span:not(:empty)]:before:shrink-0 min-w-0 overflow-hidden">mc.svg<br>@mcdotsvg
8m
getting real oppy outside.
svg]:size-5 text-body hover:bg-mix-current hover:bg-mix-amount-10 active:bg-mix-current active:bg-mix-amount-15 focus-visible:bg-mix-current focus-visible:bg-mix-amount-10 outline-current -m-2 shrink-0 cursor-pointer border-transparent p-0 text-body size-9 [&>svg]:size-[1.25em] [&>[data-engagement-icon]]:size-[1.25em] group-hover:bg-mix-current group-hover:bg-mix-amount-10" aria-label="View count" type="button" data-state="closed" href="/mcdotsvg/status/2084372976812634235/quotes">6
Log in or sign up for X<br>See what’s happening and join the conversation<br>Continue with phoneContinue with AppleContinue with Google<br>or<br>Log in with username or email
Relevant people
Greg Hunkins@greghunkinsFollow<br>Founder | Engineer | Runner | Building @MageSpace_ with @roileean
Trending now