Ransomware Attackers Target Cloud Services for Data Exfiltration

In an alarming development, ransomware attackers have increasingly turned to exploiting cloud services, such as Amazon S3 and Microsoft Azure Blob Storage, to facilitate data exfiltration and increase the pressure on their victims for ransom payments. The SentinelLabs report highlights this growing trend, where these popular cloud storage services are being leveraged for compromising IT systems.

The Growing Trend

This surge in targeting cloud services can be attributed to the increased reliance on these platforms by businesses, coupled with their relatively smaller attack surface compared to traditional endpoints and web servers. Attackers find cloud services attractive due to their widespread use, making them strategic targets for exploitation.

Primary Targets

Among the favorite targets for ransomware groups are Amazon’s Simple Storage Service (S3) and Microsoft Azure Blob Storage. These services are prone to attacks due to their extensive usage and potential security misconfigurations. Frequently, attackers exploit overly permissive S3 buckets, which can result from either misconfigurations or the use of valid credentials obtained from compromised environments.

Exploitation Techniques

AWS Key Management Service (KMS)

Attackers have developed a technique that involves scheduling a KMS key for deletion. By exploiting the seven-day deletion window, they can threaten victims with the loss of their data if ransom demands are not met. This tactic leverages the delay to buy time for negotiations and pressure victims into complying with ransom demands.

Amazon Elastic Block Store (EBS)

Similar tactics are employed with Amazon Elastic Block Store (EBS). Attackers create a new KMS key, make an encrypted snapshot of EBS volumes, and delete the originals. They again use the seven-day key deletion policy to buy time for potential ransom negotiations, adding to the pressure on victims to meet their demands.

Exfiltration Tactics

The techniques for data exfiltration have also evolved. Ransomware actors have adapted from using tools like MEGAsync and rclone to employing more sophisticated methods involving services like Azure Storage Explorer. Groups such as BianLian and Rhysida have been reported to use Azure Storage Explorer for exfiltrating data, mimicking the tactics of the notorious LockBit gang by leveraging cloud storage solutions like Amazon S3 to siphon off critical data from targeted systems.

SentinelOne’s Recommendations

To address the increasing threat of cloud-focused ransomware attacks, SentinelOne recommends several critical security measures to protect sensitive data and maintain the integrity of cloud environments.

Cloud Security Posture Management (CSPM)

Implementing CSPM solutions helps organizations discover, assess, and alert on issues within their cloud environment, particularly regarding misconfigurations and overly permissive storage buckets. This proactive approach can significantly reduce vulnerabilities that attackers seek to exploit.

Identity Management

Strong identity management practices are essential, including the enforcement of mandatory multifactor authentication (MFA) on all admin accounts. In addition, deploying runtime protection for all cloud workloads and resources helps safeguard against potential ransomware attacks and ensure a more secure cloud environment.

Conclusion

In a concerning trend, ransomware attackers have increasingly resorted to exploiting widely used cloud services like Amazon S3 and Microsoft Azure Blob Storage to exfiltrate data and increase the pressure on their targets to pay ransoms. According to SentinelLabs, this alarming shift indicates a growing pattern where these popular cloud storage services are being manipulated to compromise IT systems. These malicious actors harness the extensive resources and global accessibility of cloud platforms to steal sensitive information and amplify their coercion strategies. By leveraging these reputable cloud services, attackers can evade traditional security measures, making it harder for organizations to detect and mitigate threats promptly. This tactic not only escalates the potential damage but also complicates response efforts, as compromised data stored in the cloud can be more challenging to trace and recover. Essentially, this trend underscores the evolving sophistication of ransomware campaigns, emphasizing the need for enhanced cybersecurity measures specifically tailored to protect cloud-based infrastructures from such exploitation.

Explore more

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.

Why Choose IT Operations Over Software Development?

Choosing Between IT Operations and Software Development In today’s rapidly evolving technology landscape, career decisions in the tech field often boil down to choosing between IT operations and software development. While software development is often celebrated for its high salaries and abundance of job opportunities, IT operations offer a compelling alternative that goes beyond financial considerations. The assumption that software

Wix and ActiveCampaign Team Up to Boost Business Engagement

In an era where businesses are seeking efficient digital solutions, the partnership between Wix and ActiveCampaign marks a pivotal moment for enhancing customer engagement. As online commerce evolves, enterprises require robust tools to manage interactions across diverse geographical locations. This alliance combines Wix’s industry-leading website creation and management capabilities with ActiveCampaign’s sophisticated marketing automation platform, promising a comprehensive solution to

Top Cryptocurrencies to Watch in June 2025 for Smart Investments

Cryptocurrencies continue to reshape financial markets and offer intriguing investment opportunities for those astute enough to navigate this rapidly evolving sector. Each month, the crypto landscape introduces new contenders and reinforces existing favorites that demonstrate potential through unique value propositions and market traction. Understanding the intricacies behind these developments is crucial for investors deliberating their next move in the digital