Article
THREAT ADVISORY – RANSOMWARE CAMPAIGN TARGETING AMAZON S3 BUCKETS
Description A ransomware campaign conducted by the Codefinger group is actively targeting Amazon S3 buckets. Halcyon’s research highlights that the attacks utilize AWS Server-Side Encryption with customer-provided keys (SSE-C) to encrypt data. The attackers then demand ransom payments for the symmetric AES-256 keys required for decryption. Recovery is impossible without the key, as AWS's secure encryption infrastructure does not store it. Threat actors exploit compromised AWS credentials to execute s3: GetObject and s3: PutObject requests. They initiate encryption using the x-amz-server-side-encryption-customer-algorithm header, relying on an AES-256 encryption key generated and stored locally. Additionally, files are marked for deletion within seven days using the S3 Object Lifecycle Management API. Impact Data encrypted using SSE-C cannot be recovered without the attackers’ decryption keys. Compromised credentials enable attackers to gain access, encrypt data, and render it inaccessible. AWS CloudTrail only logs an HMAC for the encryption process, which is insufficient for key reconstruction or data recovery. Recommendations To mitigate the risk, organizations using Amazon S3 buckets should: 1. Secure AWS Accounts: Implement strict security protocols following AWS best practices. Restrict SSE-C usage by configuring the IAM policy condition element. 2. Review AWS Permissions: Limit access to minimum required levels and frequently rotate active keys. Disable unused keys. 3. Enable Detailed Logging: Monitor S3 operations for suspicious activities such as bulk encryption or policy changes. References New Amazon Ransomware Attack— ‘Recovery Impossible’ Without Payment For further assistance, contact us at info@accorian.com or schedule an appointment via our Calendly link. Threat Advisory Team Accorian
View More