Ransomware Campaign Targets Amazon S3 Buckets

A ransomware group is targeting Amazon S3 buckets, exploiting the data stored there using AWS’s server-side encryption with customer keys and demanding a ransom in exchange for the encryption key needed to unlock the data.

See Also: 2024 Threat Hunting Report: Insights to Outsmart Modern Adversaries

Threat actor, dubbed Codefinger by the Halcyon RISE team, which found the ransomware campaign does not exploit AWS vulnerabilities. Rather, it uses compromised or publicly exposed AWS account credentials.

Attackers exploit these credentials to encrypt S3 bucket data with SSE-C, which securely processes encryption keys without storing them. Once encrypted, the data becomes irrecoverable without the threat actor’s decryption key.

Halcyon’s researchers said that the operation has already impacted at least two organizations and warned about the potential for copy-cat attacks.

The encrypted files are marked for deletion within seven days, amplifying the urgency for victims to pay, researchers said.

Codefinger uses AWS-native features to execute the attack. The process begins by identifying AWS keys with permissions to read and write S3 objects. The attacker initiates encryption using an AES-256 key generated and stored locally. AWS only logs an HMAC of the key, which cannot reconstruct or decrypt the data. Lifecycle management policies are manipulated to set a seven-day deletion window, further pressuring victims.

AWS CloudTrail’s limited logging capabilities hinder forensic analysis, compounding challenges for victims and investigators.

Halcyon urged organizations to adopt robust security measures to mitigate such threats. Recommendations include restricting SSE-C usage through IAM policies, regularly auditing and rotating AWS keys and implementing advanced logging to detect unusual activities.

AWS encourages customers to utilize their security tools, such as IAM roles, Identity Center and Secrets Manager, to minimize credential exposure and improve defenses.