{"id":57409,"date":"2024-10-16T00:00:00","date_gmt":"2024-10-16T00:00:00","guid":{"rendered":"urn:uuid:8d6858bb-0901-ee32-857c-ecffa0e58860"},"modified":"2024-10-16T00:00:00","modified_gmt":"2024-10-16T00:00:00","slug":"fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/","title":{"rendered":"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data"},"content":{"rendered":"

<\/p>\n

<\/div>\n
\n
\n

When executed on the infected machine, the ransomware first performs initialization through the following steps:<\/p>\n

    \n
  1. Get the host machine universal unique identifier (UUID)<\/span><\/li>\n
  2. Import the hard-coded public key<\/span><\/li>\n<\/ol>\n

    The public key is encoded in Privacy Enhanced Mail (PEM) format<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

    \n
    \n

    Decoding the values of the public key reveals RSA encryption and the modulus size of 2048 bits.<\/p>\n

      \n
    1. A random master key is generated and encrypted using the previously imported RSA public key. (This means that only the threat actor who owns the private key can use it to decrypt the master key.)
      <\/span><\/li>\n
    2. Write the encrypted master key to the readme text file (README.txt<\/i>).
      <\/span><\/li>\n
    3. Use AWS SDK for Go v2<\/a> library\u2019s StaticCredentialsProvider to load static credentials. Static credentials include hard-coded AccessKeyID, SecretAccessKey, and AWS_REGION.<\/span><\/li>\n<\/ol><\/div>\n<\/p><\/div>\n
      \n
      \n

      After the initialization, the ransomware starts enumerating all files available in \/ (root directory for the macOS variant) by calling the filepath.Walk<\/a> function. Each enumerated file is checked to confirm if it is in the exclusion folder. If yes, such files will not be encrypted.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

      \n
      \n

      The ransomware contains a list of file extensions (usually for documents, photos, and data files) that will be encrypted.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

      \n
      \n

      The README.txt<\/i> file name is excluded from encryption.<\/p>\n

      Exfiltration<\/span><\/h2>\n

      Based on the acquired host machine UUID, the sample creates an Amazon S3 bucket on the attacker-controlled AWS account using the hard-coded pair of credentials.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

      \n
      \n

      Once the bucket has been created, the S3TA feature is enabled by modifying the configuration.<\/p>\n

      The last step is encryption of the file from the beginning to the end. The encryption algorithm is AES-CTR, with password being md5 hash file name concatenated with master key.<\/p>\n

      As an example, ransomware generates random 16-byte master key 20 60 A3 EA 54 84 C9 27 57 76 1E CC 1F FC 12. Name of the encrypted file is text.txt.<\/p>\n

      So the concatenated byte sequence is 74 65 78 74 2E 74 78 74 63 20 60 A3 EA 54 84 C9 27 57 76 1E CC 1F FC 12 and its MD5 hash is 23 a3 ec c5 58 2d 97 41 07 3c 3b dc 31 7d 49 30.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

      \n
      \n

      Files are then uploaded from the victim\u2019s machine to the attacker-controlled AWS account.<\/p>\n

      S3TA enables users to achieve faster data transfer over long distances. It leverages the globally distributed edge locations in Amazon CloudFront. To use this feature, it must be enabled on the bucket. The bucket name should be Domain Name System (DNS) compliant and must not have periods. An S3 bucket with S3TA enabled can be accessed by the following endpoints, depending on the type of AWS environment:<\/p>\n

        \n
      1. bucketname[.]s3-accelerate.amazonaws.com<\/span><\/li>\n
      2. bucketname[.]s3-accelerate.dualstack.amazonaws.com<\/span><\/li>\n<\/ol>\n

        Each file, which passed the previous file extension checks and is smaller than 100 mebibytes (MiB), is uploaded to AWS by calling the Uploader.Upload<\/a> function. This is due to saving AWS space and funds, as uploading big files will cost attackers more money.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        The last step is encryption of the file from beginning to end. The encryption algorithm is AES-CTR, with the password being the MD5 hash of the file name concatenated with the master key.<\/p>\n

        The ransomware generates a random 16-byte master key (for example 63 20 60 A3 EA 54 84 C9 27 57 76 1E CC 1F FC 12). The name of the encrypted file is text.txt.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        Correspondingly, the concatenated byte sequence is 74 65 78 74 2E 74 78 74 63 20 60 A3 EA 54 84 C9 27 57 76 1E CC 1F FC 12 and its MD5 hash is 23 a3 ec c5 58 2d 97 41 07 3c 3b dc 31 7d 49 30. This is shown in the screenshot below (generated via CyberChef<\/a>, used here for visualization purposes only).<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        This resulting hash is used as AES key parameter of crypto.AES.NewCipher function<\/a>. The initialization vector is a randomly generated 16-bytes and is passed into crypto.cipher.NewCTR function.<\/p>\n

        After the encryption, the file is renamed according to the following format: <original file name>.<initialization vector>.abcd. For instance, the file text.txt<\/i> was renamed to text.txt.e5c331611dd7462f42a5e9776d2281d3.abcd<\/i>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        We ran the ransomware sample in the debugger and dump master key. Then we verified that we can correctly decrypt the previously encrypted file by choosing the proper cipher and passing the correct parameters, as shown in the screenshot below (generated via CyberChef<\/a>, used here for visualization purposes only).<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        The README.txt<\/i> file contains base64 encoded content. Decoding it reveals the master key encrypted by crypto.rsa.EncryptPKCS1v15 with a hard-coded public key as its parameter, then encoded by base64. This base64 encoded blob is followed by hostname, OS version, and infected machine identifier. To decrypt the master key, we would need the ransomware developer\u2019s private key, which we do not have.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        After all files are processed, the ransomware changes the device\u2019s wallpaper. We observed two different wallpapers in use, and both have been stolen or copied either from LockBit attacks or from a security blog<\/a> mentioning the ransomware family. It should be noted however that 2.0 is not the latest LockBit version<\/a>. Furthermore, key figures behind the ransomware operations have just been apprehended earlier this year<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        On macOS, the ransomware uses osascript<\/a> to change the wallpaper. The osascript command is as follows:
        \u201ctell application “System Events” to tell every desktop to set picture to “%s\u201d.<\/p>\n

        On Windows, the ransomware calls SystemParametersInfoW<\/a> with uiAction parameter set to SPI_SETDESKWALLPAPER to change the wallpaper.<\/p>\n

        In some Windows samples, we can also find code for deleting backups (shadow copy<\/a>). Interestingly, the ransomware developer likely, without understanding, copied shadowcopy.go<\/i> from a ransomware-simulator<\/a> project and left the  parameter \/for<\/a> unchanged.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        \n
        \n

        Conclusion<\/span><\/h2>\n

        Attackers are increasingly leveraging cloud services and features to further their malicious activities. In this blog, we analyzed a Golang ransomware that abuses Amazon S3’s Transfer Acceleration feature to upload victim files to attacker-controlled S3 buckets. Such advanced capabilities enable attackers to efficiently exfiltrate data as they take advantage of cloud service providers.<\/p>\n

        Furthermore, account identifiers of cloud providers such as AWS Account IDs linked to malicious activities can serve as valuable IOCs. By tracking these IDs, defenders can better identify and mitigate threats within their cloud environments, underscoring the need for vigilant monitoring of cloud resources.<\/p>\n

        Threat actors might also disguise their ransomware sample as another more publicly known variant, and it is not difficult to see why: the infamy of high-profile ransomware attacks further pressures victims into doing the attacker\u2019s bidding.<\/p>\n

        To further boost security, organizations can also employ security solutions such as Vision One<\/a> to detect and stop threats early and no matter where they are in the system.<\/p>\n

        AWS Security Feedback<\/span><\/h2>\n

        We contacted AWS about this incident and received the following comment:<\/p>\n

        AWS can confirm that AWS services are operating as intended. The activity identified violates the AWS acceptable use policy<\/a> and the reported AWS access keys and account have been suspended.<\/p>\n

        Ransomware is not specific to any computing environment in particular. However, AWS provides customers with increased visibility into and control over their security posture with respect to malware<\/a>.<\/p>\n

        We recommend customers who suspect or become aware of AWS resources being used for suspicious activity to complete the abuse form<\/a> or contact trustandsafety@support.aws.com<\/a>.<\/p>\n

        We thank Trend Micro for engaging AWS Security.<\/p>\n

        Indicators of Compromise<\/b><\/span><\/b><\/h2>\n

        During our monitoring, we have seen different versions of this ransomware. All had encryption features, but only some had upload functionality and valid tokens. This, along with other differences among variants, suggests that the ransomware is still in development.<\/p>\n

        The full list of IOCs can be found here<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

        Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

        This article uncovers a Golang ransomware abusing AWS S3 for data theft, and masking as LockBit to further pressure victims. The discovery of hard-coded AWS credentials in these samples led to AWS account suspensions. Read More HERE…<\/p>\n","protected":false},"author":2,"featured_media":57410,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9520,9539,9509],"class_list":["post-57409","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-cloud","tag-trend-micro-research-ransomware","tag-trend-micro-research-research"],"yoast_head":"\nFake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-10-16T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/newgolang:Large?qlt=80\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data\",\"datePublished\":\"2024-10-16T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/\"},\"wordCount\":1234,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Cloud\",\"Trend Micro Research : Ransomware\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/\",\"name\":\"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png\",\"datePublished\":\"2024-10-16T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png\",\"width\":976,\"height\":533},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/","og_locale":"en_US","og_type":"article","og_title":"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-10-16T00:00:00+00:00","og_image":[{"url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/newgolang:Large?qlt=80","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data","datePublished":"2024-10-16T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/"},"wordCount":1234,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/10\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Cloud","Trend Micro Research : Ransomware","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/","url":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/","name":"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/10\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png","datePublished":"2024-10-16T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/10\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/10\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data.png","width":976,"height":533},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/57409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=57409"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/57409\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/57410"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=57409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=57409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=57409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}