- Attackers gain access to storage buckets with exposed AWS keys
- The files are then encrypted and scheduled for deletion after one week
- Halycon says it observed at least two victims being attacked this way
Cybercriminals have begun exploiting legitimate AWS S3 capabilities to encrypt victim buckets in a unique twist to the old ransomware attack.
Researchers from Halycon have recently observed several victims, all AWS native software developers, being attacked in this way. In the attack, the group, called Codefinger, gained access to their victims’ cloud storage locations through publicly exposed or otherwise compromised AWS keys with read and write permissions.
After accessing the buckets, they would use AWS server-side encryption with customer-supplied keys (SSE-C) to lock the files.
Marking files for deletion
But this is not where the creativity ends with Codefinger. The group is not threatening to release the files to the public or delete them. Instead, it marks all the encrypted files for deletion within a week, also using AWS S3 native features.
speaks to The registerHalcyon RISE Team VP of Services Tim West said this was the first time someone had abused the AWS native secure encryption infrastructure via SSE-C.
“Historically, AWS Identity IAM keys have been leaked and used for data theft, but if this approach gains widespread adoption, it could pose a significant systemic risk to organizations that rely on AWS S3 to store critical data,” he told the publication .
“This is unique in that most ransomware operators and associated attackers do not engage in direct data destruction as part of a double extortion scheme or to otherwise pressure the victim to pay the ransom,” West said. “Data destruction represents an additional risk to targeted organizations.”
Halcyon did not want to name the victims and instead encouraged AWS customers to limit the use of SSE-C.
Amazon, on the other hand, told The register it does what it can when it detects exposed keys and encouraged customers to follow best practices when it comes to cybersecurity.
