Google Threat Intelligence Group (GTIG) / Google Cloud
UNC4899 social-engineering intrusions into Google Cloud and AWS environments leading to cryptocurrency theft (Q3 2024 to Q1 2025) · Cloud Threat Horizons Report H2 2025 (no exact date on page)
Between Q3 2024 and Q1 2025, Mandiant responded to two incidents at two separate organizations that we attribute to UNC4899, with one incident affecting a victim’s Google Cloud environment and the other affecting a victim’s AWS environment. ... Soon after, UNC4899 successfully stole several million dollars worth of cryptocurrency (Fig. 4).