Act fast to blunt a new ransomware attack on AWS S3 buckets

ONE SENTENCE SUMMARY: CISOs are urged to secure AWS access keys after a ransomware attack exploits stolen credentials and AWS encryption.
MAIN POINTS:
Attackers target Amazon S3 buckets using stolen login passwords for ransomware attacks.
Data becomes unrecoverable via AWS encryption without paying a ransom for the decryption key.
Codefinger is the alleged attacker leveraging AWS’s encryption infrastructure against organizations.
The attack does not exploit AWS vulnerabilities but relies on stolen account credentials.
Ransomware capabilities evolve as SSE-C encrypts data, demanding keys for recovery from victims.
Encrypted files pressure victims with a deletion deadline of seven days.
Keys can be compromised through phishing, IT network breaches, or leaked code repositories.
AWS CloudTrail logs do not provide sufficient data for recovery or forensic analysis.
IT administrators are advised to manage IAM policies and S3 bucket access securely.
Past attacks have exploited AWS keys through misconfigurations and public exposure.
TAKEAWAYS:
Securing AWS access keys is critical to prevent sophisticated ransomware attacks.
Implement IAM policies to restrict unauthorized access to encryption features in S3.
Regularly review and rotate AWS keys to minimize security risks.
Utilize AWS Security Token Service for temporary credentials to enhance security.
Follow best practices for handling sensitive data in environment files to prevent leaks.