Home / server / Questions / 1085232
In Process
Sherif Buzz
Asked: 2021-12-03 10:56:09 +0800 CST

Action Required: Suspicious Activity Observed on Google Cloud Project

  • 772

I received the following email from Google today. Ran multiple scans on our system and nothing came out - the destination IP address they sent is a Facebook IP. Does this make any sense? We run Facebook Ads - and my only explanation is that somehow a malicious ad made it into their ad network.

Any assistance much appreciated.

Our systems identified that your Google Cloud Platform / API Project ID [] may have been compromised and used for cryptocurrency mining.

This activity was detected as originating from IP XXX and VM ID XX to destination IP 31.13.86.8 on remote port 443 between 2021-12-02 01:34 and 2021-12-02 01:45 (Pacific Time), though it may still be ongoing.

security

0 Answers

  1. These are the GCP’s recommended steps when a user faces that warning message:

    -Stop the instance immediately.

    -Notify impacted users; they might be wondering why your service is down.

    -Identify the source of the vulnerability by analyzing the behavior of your instance and the software you've installed.

    -Ensure that all the software is up to date. Check for any known vulnerabilities in the software installed on your machine and take proactive steps to apply the latest security patches.

    -Adopt additional security measures to ensure that your project is not compromised by a third party and then completely reinstall your project.

    -Follow the guidelines in What can I do to protect my instance? (above) to ensure your project is secure going forward.

    -If you received a warning from Google Cloud Platform about suspicious behavior by your project, appeal the warning by going to the Google Cloud -Platform console and explaining the steps you took to secure the instance.

    GCP does not have visibility into what is installed on your instance or what software caused the issue. You are responsible for investigating the source of vulnerability and taking steps to mitigate it. If you need any additional support to troubleshoot the issue please refer to the Cloud Platform Support page Cloud Platform Support.

    You can visit the following GCP’s official information URL as a reference Securing instances:

    • 0