Ransomware Crew Abuses AWS Native Encryption, Sets Data-Destruct Timer for 7 Days

A new ransomware group called Codefinger targets AWS S3 buckets by exploiting compromised or publicly exposed AWS keys to encrypt victims' data using AWS's own SSE-C encryption, rendering it inaccessible without the attacker-generated AES-256 keys. While other security researchers have documented techniques for encrypting S3 buckets, 'this is the first instance we know of leveraging AWS's native secure encryption infrastructure via SSE-C in the wild,' Tim West, VP of services with the Halcyon RISE Team, told The Register. 'Historically AWS Identity IAM keys are leaked and used for data theft but if this approach gains widespread adoption, it could represent a significant systemic risk to organizations relying on AWS S3 for the storage of critical data,' he warned. From the report:... in addition to encrypting the data, Codefinder marks the compromised files for deletion within seven days using the S3 Object Lifecycle Management API â' the criminals themselves do not threaten to leak or sell the data, we're told. 'This is unique in that most ransomware operators and affiliate attackers do not engage in straight up data destruction as part of a double extortion scheme or to otherwise put pressure on the victim to pay the ransom demand,' West said. 'Data destruction represents an additional risk to targeted organizations.'

Codefinger also leaves a ransom note in each affected directory that includes the attacker's Bitcoin address and a client ID associated with the encrypted data. 'The note warns that changes to account permissions or files will end negotiations,' the Halcyon researchers said in a report about S3 bucket attacks shared with The Register. While West declined to name or provide any additional details about the two Codefinger victims -- including if they paid the ransom demands -- he suggests that AWS customers restrict the use of SSE-C.

'This can be achieved by leveraging the Condition element in IAM policies to prevent unauthorized applications of SSE-C on S3 buckets, ensuring that only approved data and users can utilize this feature,' he explained. Plus, it's important to monitor and regularly audit AWS keys, as these make very attractive targets for all types of criminals looking to break into companies' cloud environments and steal data. 'Permissions should be reviewed frequently to confirm they align with the principle of least privilege, while unused keys should be disabled, and active ones rotated regularly to minimize exposure,' West said. An AWS spokesperson said it notifies affected customers of exposed keys and 'quickly takes any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment.'

They also directed users to this post about what to do upon noticing unauthorized activity.

Read more of this story at Slashdot.