We're witnessing the evolution of ransomware.
Yesterday someone informed us of the existence of the new TTP of AWS S3 extortion. More specifically, Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider).
Yesterday someone informed us of the existence of the new TTP of AWS S3 extortion. More specifically, Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider).
Comments
Worst thing about AWS : Granular control
This is just another 'taking advantage of poor hygiene' attack.
It's not without merit, but it's not 'abusing the KMS' , it's abusing a poorly configured AWS
While this threat is worrisome, it is still based on the same bad practices that allow it to happen.
Thanks for sharing.
the AWS root account owns everything KMS.