Cloud Abuse at Scale - How Cybercriminals Exploit Free Tiers for Profit

Explore how cybercriminals systematically exploit cloud providers' free tier offerings in this 24-minute conference talk from fwd:cloudsec Europe 2025. Discover the coordinated tactics, techniques, and procedures (TTPs) threat actors use to abuse free-tier resources, particularly those with GPU or ML capabilities, for financial gain. Learn about the complete attack lifecycle, from automated cloud account generation using browser extensions and iMacros scripts to infrastructure validation, deployment, and resale on underground marketplaces. Examine the broader monetization ecosystem and understand how adversaries integrate with e-commerce platforms to scale their operations. Gain insights into real-world indicators, case study elements, and tooling details that will help you recognize and disrupt similar activities in your environment. Understand the underground economy built around cloud abuse and acquire actionable defense strategies to protect against these sophisticated threats.