Exposed Training Apps in Fortune 500 Clouds: How Demo Environments Became Crypto-Mining Hotspots

Organizations worldwide rely on intentionally vulnerable applications like OWASP Juice Shop, DVWA, Hackazon, and bWAPP for security training and demonstrations. These tools are deliberately designed with security flaws to help professionals understand attack techniques in controlled environments. However, Pentera Labs' recent research reveals a troubling pattern: these training applications are frequently deployed in production cloud environments with dangerous misconfigurations that expose organizations to real-world attacks.

The Hidden Risk in Cloud Training Environments

The core issue isn't the training applications themselves, but how they're deployed and maintained. Pentera Labs discovered that applications intended for isolated lab use were often found exposed to the public internet, running inside active cloud accounts, and connected to cloud identities with broader access than necessary.

This creates a perfect storm for attackers. When a training application is connected to privileged cloud identities, a single vulnerability can serve as an entry point to the entire cloud infrastructure. Attackers can move far beyond the original application, potentially gaining access to other critical resources within the same environment.

Scale of the Problem

Pentera Labs' investigation uncovered nearly 2,000 live, exposed training application instances across major cloud providers. Of these, approximately 60% were hosted on customer-managed infrastructure running on AWS, Azure, or GCP. The scope extends beyond small test systems - these exposed environments were found in cloud infrastructures associated with Fortune 500 organizations and leading cybersecurity vendors, including Palo Alto, F5, and Cloudflare.

Active Exploitation in the Wild

What makes this particularly concerning is that these aren't theoretical vulnerabilities. Pentera Labs observed clear evidence of active exploitation. Across the dataset of exposed training applications, approximately 20% contained artifacts deployed by malicious actors, including:

• Crypto-mining activity
• Webshells for persistent access
• Various persistence mechanisms

The presence of active crypto-mining demonstrates that exposed training applications are not only discoverable but are already being exploited at scale. Attackers are actively using these misconfigured environments to generate cryptocurrency at the expense of victim organizations.

Why Traditional Security Measures Fail

Training and demo environments are frequently treated as low-risk or temporary assets. This perception leads to several critical security gaps:

• Exclusion from standard security monitoring
• Lack of access reviews and lifecycle management
• Minimal isolation from production resources
• Default configurations left unchanged
• Overly permissive cloud roles and permissions

Over time, these environments may remain exposed long after their original purpose has passed, creating persistent security risks that organizations may not even be aware of.

The Attack Vector: Simplicity Over Sophistication

What's particularly alarming about these findings is that exploitation doesn't require zero-day vulnerabilities or advanced attack techniques. Attackers are successfully compromising these environments using:

• Default credentials that were never changed
• Known vulnerabilities in the training applications
• Public exposure that makes discovery trivial

The simplicity of these attacks underscores how basic security hygiene can prevent what could otherwise become major security incidents.

Real-World Impact on Major Organizations

The research revealed that this deployment pattern wasn't limited to small organizations or isolated test systems. Pentera Labs observed this across cloud environments associated with major corporations and cybersecurity vendors. This demonstrates that even organizations with sophisticated security programs can fall victim to these basic misconfigurations when it comes to training and demo environments.

Recommendations for Organizations

To address this growing threat, organizations should implement several key security measures:

1. Treat Training Environments as Production Assets

• Apply the same security standards to training environments as production systems
• Include them in regular security assessments and monitoring
• Implement proper access controls and authentication

2. Network Isolation

• Deploy training applications in isolated network segments
• Use network segmentation to prevent lateral movement
• Implement proper firewall rules and access controls

3. Cloud Identity Management

• Use least-privilege principles for cloud roles and permissions
• Regularly review and audit cloud identity assignments
• Implement just-in-time access for training environments

4. Lifecycle Management

• Establish clear decommissioning procedures for temporary environments
• Implement automated cleanup processes
• Regular inventory and assessment of all training assets

5. Monitoring and Detection

• Monitor training environments for suspicious activity
• Implement intrusion detection systems
• Regular vulnerability scanning and penetration testing

The Broader Security Implications

This research highlights a fundamental challenge in modern cloud security: the gap between security best practices and operational reality. Organizations invest heavily in securing their production environments but often overlook the security implications of their training and development infrastructure.

The fact that these vulnerabilities are being actively exploited for crypto-mining demonstrates that attackers are systematically scanning for and targeting these misconfigurations. This represents a shift from opportunistic attacks to targeted campaigns against poorly secured cloud resources.

Moving Forward

The findings from Pentera Labs serve as a wake-up call for organizations of all sizes. Training and demo environments, when improperly configured, can become significant security liabilities rather than valuable educational tools.

Organizations must recognize that in today's interconnected cloud environments, there is no such thing as a "low-risk" application. Any system connected to the internet and cloud infrastructure, regardless of its intended purpose, represents a potential attack surface that must be properly secured.

For more detailed information about the research methodology and findings, Pentera Labs is hosting a live webinar on February 12th. Organizations concerned about their cloud security posture should consider attending to learn more about protecting their training environments from exploitation.

This article was written by Noam Yaffe, Senior Security Researcher at Pentera Labs. For questions or discussion, contact [email protected]