Hackers who were able to steal data belonging to two AWS customers used the platform’s encryption capabilities to conduct a novel type of ransomware attack, researchers have warned.
A new report from cyber resilience firm Halcyon’s RISE team identified a new ransomware campaign targeting Amazon S3 buckets, where the attackers leverage AWS’ server-side encryption along with the Customer Provided Keys (SSE-C) to encrypt victim data.
The group, referred to as ‘Codefinger’ in the report, is reported to have attacked at least two victims, but the technique represents a worrying development as it requires no exploitation of vulnerabilities in the AWS platform.
Instead, if the threat actor is able to steal a customer’s account credentials they are able to use AWS’ secure encryption infrastructure to lockdown the victim’s data, with no known method of recovery without meeting their demands.
The attacker generates and stores AES-256 encryption keys locally, and Halcyon noted that because AWS does not store the encryption key it cannot help recover the data when victims report an attack.
AWS only logs a hash-based message authentication code (HMAC) of the key in its governance service, which the report states is insufficient for recovering any encrypted data, or for forensic analysis of the attack either.
Once they have encrypted the victim’s assets, the files are marked for deletion within seven days in order to coerce the victims into paying, warning them not to try to alter their account permissions and interfere with their access.
Hardening Amazon S3 to avoid compromise
The report noted that although Amazon’s server-side encryption feature has been around for some time, this looks like the first time ransomware operators have used it for malicious purposes, stating that it identified two victims who were impacted by the attack “in recent weeks”.
Halcyon said AWS users can mitigate the threat and harden their AWS environments by restricting SSE-C usage, monitoring and auditing their keys, and implementing advanced logging.
Customers should regularly review permissions for their AWS keys, Halcyon advised adding they should also disable unused keys and rotate active keys frequently.
ITPro approached AWS for a statement on the technique and a spokesperson for the firm said it protects customers to the best of its ability when their keys are exposed, pointing to its shared responsibility model for cloud assets.
RELATED WHITEPAPER
“AWS helps customers secure their cloud resources through a shared responsibility model. Anytime AWS is aware of exposed keys, we notify the affected customers,” the spokesperson said.
“We also thoroughly investigate all reports of exposed keys and quickly take any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment.”
The spokesperson added that all customers are strongly advised to act quickly if they believe their credentials may have been compromised.
“We encourage all customers to follow security, identity, and compliance best practices. In the event a customer suspects they may have exposed their credentials, they can start by following the steps listed in this post. As always, customers can contact AWS Support with any questions or concerns about the security of their account.”
-
Using DeepSeek at work is like ‘printing out and handing over your confidential information’News Thinking of using DeepSeek at work? Think again. Cybersecurity experts have warned you're putting your enterprise at huge risk.
-
Can cyber group takedowns last?ITPro Podcast Threat groups can recover from website takeovers or rebrand for new activity – but each successful sting provides researchers with valuable data
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
