Ransomware Exploits Amazon S3 Encryption to Lock Data

A new ransomware campaign has emerged, targeting Amazon Web Services (AWS) Simple Storage Service (S3) buckets by exploiting AWS's Server-Side Encryption with Customer Provided Keys (SSE-C). This method allows attackers to encrypt data using keys known only to them, rendering the data inaccessible without payment.

Attack Methodology

The threat actor, identified as "Codefinger," utilizes compromised or publicly exposed AWS credentials with permissions to read and write S3 objects. By leveraging the SSE-C feature, they encrypt data in S3 buckets with AES-256 encryption keys that only they possess. Since AWS does not store these keys, data recovery is impossible without the attacker's cooperation.

Implications for AWS Users

This attack highlights the risks associated with misconfigured permissions and the importance of securing access credentials. Organizations relying on AWS for data storage must ensure that their access controls are properly configured to prevent unauthorized access.

Mitigation Strategies

• Secure Access Credentials: Regularly audit and rotate AWS access keys to prevent unauthorized use.
• Implement Least Privilege Access: Ensure that IAM policies grant the minimum necessary permissions to users and applications.
• Monitor for Suspicious Activity: Utilize AWS CloudTrail and other monitoring tools to detect unusual access patterns or configuration changes.
• Regular Backups: Maintain regular backups of critical data in secure, isolated environments to facilitate recovery in case of an attack.

Conclusion

The exploitation of AWS's SSE-C feature by ransomware actors underscores the need for robust security practices in cloud environments. By implementing stringent access controls and monitoring mechanisms, organizations can mitigate the risk of such attacks and protect their data from unauthorized encryption.

Sources

• Ransomware abuses Amazon AWS feature to encrypt S3 buckets
• New Amazon Ransomware Attack—‘Recovery Impossible’ Without Payment
• Act fast to blunt a new ransomware attack on AWS S3 buckets
• Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C
• The anatomy of ransomware event targeting data residing in Amazon S3