In an alarming development, ransomware attackers have increasingly turned to exploiting cloud services, such as Amazon S3 and Microsoft Azure Blob Storage, to facilitate data exfiltration and increase the pressure on their victims for ransom payments. The SentinelLabs report highlights this growing trend, where these popular cloud storage services are being leveraged for compromising IT systems.
The Growing Trend
This surge in targeting cloud services can be attributed to the increased reliance on these platforms by businesses, coupled with their relatively smaller attack surface compared to traditional endpoints and web servers. Attackers find cloud services attractive due to their widespread use, making them strategic targets for exploitation.
Primary Targets
Among the favorite targets for ransomware groups are Amazon’s Simple Storage Service (S3) and Microsoft Azure Blob Storage. These services are prone to attacks due to their extensive usage and potential security misconfigurations. Frequently, attackers exploit overly permissive S3 buckets, which can result from either misconfigurations or the use of valid credentials obtained from compromised environments.
Exploitation Techniques
AWS Key Management Service (KMS)
Attackers have developed a technique that involves scheduling a KMS key for deletion. By exploiting the seven-day deletion window, they can threaten victims with the loss of their data if ransom demands are not met. This tactic leverages the delay to buy time for negotiations and pressure victims into complying with ransom demands.
Amazon Elastic Block Store (EBS)
Similar tactics are employed with Amazon Elastic Block Store (EBS). Attackers create a new KMS key, make an encrypted snapshot of EBS volumes, and delete the originals. They again use the seven-day key deletion policy to buy time for potential ransom negotiations, adding to the pressure on victims to meet their demands.
Exfiltration Tactics
The techniques for data exfiltration have also evolved. Ransomware actors have adapted from using tools like MEGAsync and rclone to employing more sophisticated methods involving services like Azure Storage Explorer. Groups such as BianLian and Rhysida have been reported to use Azure Storage Explorer for exfiltrating data, mimicking the tactics of the notorious LockBit gang by leveraging cloud storage solutions like Amazon S3 to siphon off critical data from targeted systems.
SentinelOne’s Recommendations
To address the increasing threat of cloud-focused ransomware attacks, SentinelOne recommends several critical security measures to protect sensitive data and maintain the integrity of cloud environments.
Cloud Security Posture Management (CSPM)
Implementing CSPM solutions helps organizations discover, assess, and alert on issues within their cloud environment, particularly regarding misconfigurations and overly permissive storage buckets. This proactive approach can significantly reduce vulnerabilities that attackers seek to exploit.
Identity Management
Strong identity management practices are essential, including the enforcement of mandatory multifactor authentication (MFA) on all admin accounts. In addition, deploying runtime protection for all cloud workloads and resources helps safeguard against potential ransomware attacks and ensure a more secure cloud environment.
Conclusion
In a concerning trend, ransomware attackers have increasingly resorted to exploiting widely used cloud services like Amazon S3 and Microsoft Azure Blob Storage to exfiltrate data and increase the pressure on their targets to pay ransoms. According to SentinelLabs, this alarming shift indicates a growing pattern where these popular cloud storage services are being manipulated to compromise IT systems. These malicious actors harness the extensive resources and global accessibility of cloud platforms to steal sensitive information and amplify their coercion strategies. By leveraging these reputable cloud services, attackers can evade traditional security measures, making it harder for organizations to detect and mitigate threats promptly. This tactic not only escalates the potential damage but also complicates response efforts, as compromised data stored in the cloud can be more challenging to trace and recover. Essentially, this trend underscores the evolving sophistication of ransomware campaigns, emphasizing the need for enhanced cybersecurity measures specifically tailored to protect cloud-based infrastructures from such exploitation.