{"id":57587,"date":"2024-10-16T00:00:00","date_gmt":"2024-10-16T00:00:00","guid":{"rendered":"urn:uuid:8949ce10-4ab1-cc55-923b-3464cd19ada3"},"modified":"2024-10-16T00:00:00","modified_gmt":"2024-10-16T00:00:00","slug":"fake-lockbit-real-damage-ransomware-samples-abuse-amazon-s3-to-steal-data","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fake-lockbit-real-damage-ransomware-samples-abuse-amazon-s3-to-steal-data\/","title":{"rendered":"Fake LockBit, Real Damage: Ransomware Samples Abuse Amazon S3 to Steal Data"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Conclusion<\/span><\/h2>\n

Attackers are increasingly leveraging cloud services and features to further their malicious activities. In this blog, we analyzed a Golang ransomware that abuses Amazon S3’s Transfer Acceleration feature to upload victim files to attacker-controlled S3 buckets. Such advanced capabilities enable attackers to efficiently exfiltrate data as they take advantage of cloud service providers.<\/p>\n

Furthermore, account identifiers of cloud providers such as AWS Account IDs linked to malicious activities can serve as valuable IOCs. By tracking these IDs, defenders can better identify and mitigate threats within their cloud environments, underscoring the need for vigilant monitoring of cloud resources.<\/p>\n

Threat actors might also disguise their ransomware sample as another more publicly known variant, and it is not difficult to see why: the infamy of high-profile ransomware attacks further pressures victims into doing the attacker\u2019s bidding.<\/p>\n

To further boost security, organizations can also employ security solutions such as Vision One<\/a> to detect and stop threats early and no matter where they are in the system.<\/p>\n

AWS Security Feedback<\/span><\/h2>\n

We contacted AWS about this incident and received the following comment:<\/p>\n

AWS can confirm that AWS services are operating as intended. The activity identified violates the AWS acceptable use policy<\/a> and the reported AWS access keys and account have been suspended.<\/p>\n

Ransomware is not specific to any computing environment in particular. However, AWS provides customers with increased visibility into and control over their security posture with respect to malware<\/a>.<\/p>\n

We recommend customers who suspect or become aware of AWS resources being used for suspicious activity to complete the abuse form<\/a> or contact trustandsafety@support.aws.com<\/a>.<\/p>\n

We thank Trend Micro for engaging AWS Security.<\/p>\n

Trend Micro Vision One Threat Intelligence<\/span><\/h2>\n

To stay ahead of evolving threats, Trend Micro customers can access a range of Intelligence Reports and Threat Insights within Trend Micro Vision One. Threat Insights helps customers stay ahead of cyber threats before they happen and better prepared for emerging threats. It offers comprehensive information on threat actors, their malicious activities, and the techniques they use. By leveraging this intelligence, customers can take proactive steps to protect their environments, mitigate risks, and respond effectively to threats.<\/p>\n

Trend Micro Vision One Intelligence Reports App [IOC Sweeping]<\/b><\/p>\n