Exposed Training Open the Door for Crypto-Mining in Fortune 500 Cloud Environments
Published: (February 11, 2026 at 06:30 AM EST)
4 min read
Source: The Hacker News
Source: The Hacker News
[](https://go.pentera.io/pentera-labs-exposed-cloud-training-apps?utm_source=thn&utm_medium=eblast&utm_campaign=pentera_labs_door)
Intentionally vulnerable training applications are widely used for security education, internal testing, and product demonstrations. Tools such as **OWASP Juice Shop**, **DVWA**, **Hackazon**, and **bWAPP** are designed to be insecure by default, making them useful for learning how common attack techniques work in controlled environments.
The issue is not the applications themselves, but how they are often deployed and maintained in real‑world cloud environments.
Pentera Labs examined how training and demo applications are being used across cloud infrastructures and identified a recurring pattern: applications intended for isolated lab use were frequently found **exposed to the public internet**, running inside active cloud accounts, and connected to cloud identities with broader access than required.
---
### Deployment Patterns Observed in the Research
[Pentera Labs research](https://go.pentera.io/pentera-labs-exposed-cloud-training-apps?utm_source=thn&utm_medium=eblast&utm_campaign=pentera_labs_door) found that these applications were often deployed with **default configurations**, **minimal isolation**, and **overly permissive cloud roles**. The investigation uncovered that many of these exposed training environments were directly connected to active cloud identities and privileged roles, enabling attackers to move far beyond the vulnerable applications themselves and potentially into the customer’s broader cloud infrastructure.
In these scenarios, a single exposed training application can act as an **initial foothold**. Once attackers leverage connected cloud identities and privileged roles, they are no longer constrained to the original application or host. Instead, they may gain the ability to interact with other resources within the same cloud environment, significantly increasing the scope and potential impact of the compromise.
As part of the investigation, Pentera Labs verified nearly **2,000 live, exposed training application instances**, with close to **60 % hosted on customer‑managed infrastructure running on AWS, Azure, or GCP**.
[](https://go.pentera.io/pentera-labs-exposed-cloud-training-apps?utm_source=thn&utm_medium=eblast&utm_campaign=pentera_labs_door)
---
### Evidence of Active Exploitation
The exposed training environments identified during the research were not simply misconfigured. Pentera Labs observed clear evidence that attackers were **actively exploiting this exposure in the wild**.
Across the broader dataset of exposed training applications, approximately **20 % of instances contained artifacts deployed by malicious actors**, including:
- Crypto‑mining activity
- Webshells
- Persistence mechanisms
These artifacts indicate prior compromise and ongoing abuse of exposed systems. The presence of active crypto‑mining and persistence tooling demonstrates that exposed training applications are not only discoverable but are already being exploited at scale.
---
### Scope of Impact
The exposed and exploited environments were not limited to small or isolated test systems. Pentera Labs observed this deployment pattern across cloud environments associated with **Fortune 500 organizations and leading cybersecurity vendors**, including **Palo Alto**, **F5**, and **Cloudflare**.
While individual environments varied, the underlying pattern remained consistent:
> A training or demo application deployed without sufficient isolation, left publicly accessible, and connected to privileged cloud identities.
---
### Why This Matters
Training and demo environments are frequently treated as **low‑risk or temporary assets**. As a result, they are often excluded from standard security monitoring, access reviews, and lifecycle‑management processes. Over time, these environments may remain exposed long after their original purpose has passed.
The research shows that exploitation does **not** require zero‑day vulnerabilities or advanced attack techniques. Default credentials, known weaknesses, and public exposure were sufficient to turn training applications into an entry point for broader cloud access.
Labeling an environment as “training” or “test” does **not** reduce its risk. When exposed to the internet and connected to privileged cloud identities, these systems become part of the organization’s effective attack surface.
---
**Further Reading & Resources**
- Full **[Pentera Labs research blog](https://go.pentera.io/pentera-labs-exposed-cloud-training-apps?utm_source=thn&utm_medium=eblast&utm_campaign=pentera_labs_door)**
- **[Live webinar – Feb 12](https://go.pentera.io/pentera-labs-exposed-cloud-training-apps-webinar?utm_source=THN&source=THN&utm_medium=article&medium=article&utm_campaign=pentera%20labs%20door&campaign=pentera%20labs%20door)** – methodology, discovery process, and real‑world exploitation observed during this research.
*This article was written by **Noam Yaffe**, Senior Security Researcher at Pentera Labs. For questions or discussion, contact [labs@pentera.io](mailto:labs@pentera.io).*
---
**Follow Us**
- [Google News](https://news.google.com/publications/CAAqLQgKIidDQklTRndnTWFoTUtFWFJvWldoaFkydGxjbTVsZDNNdVkyOXRLQUFQAQ)
- [Twitter](https://twitter.com/thehackersnews)
- [LinkedIn](https://www.linkedin.com/company/thehackersnews) [LinkedIn](https://linkedin.com/company/thehackernews/) to read more exclusive content we post.