
A new ransomware attack targeting Amazon Web Services (AWS) has been reported, with experts indicating that recovery from the attack may be impossible without payment. The ransomware exploits user negligence regarding AWS's S3 storage service, specifically targeting S3 buckets. Additionally, the attack utilizes Amazon's native encryption methods, complicating recovery efforts. Security analysts have warned that organizations should renew their AWS keys to mitigate risks associated with this vulnerability. The attack has drawn attention for its sophisticated use of encryption, which keeps the encryption key secret from victims.
This has an important distinction compared to previous reports of PoC ransomware utilizing the KMS. This actual ransomware uses S3 SSE-C, which puts encryption key material in the `x-amz-server-side-encryption-customer-key` header. That way, threat actor keeps enc key secret. https://t.co/irvC38gTkx
Ransomware crew abuses AWS native encryption • The Register https://t.co/jP3yJ8A7XV
🚨New Amazon Ransomware Attack—‘Recovery Impossible’ Without Payment 🚨 https://t.co/QEYQqKzKtX