Detecting and Blocking S3 Ransomware with CloudTrail and Resource Control Policies

Summary

The presenter demonstrates how an attacker with compromised or overly permissive AWS credentials could encrypt and overwrite S3 objects using a customer-provided key, then shows CloudTrail/Athena detection and an RCP prevention control.

Key points

The presenter cites reports from Singapore’s Cyber Security Agency of an ongoing campaign targeting Amazon S3 buckets.
The described access paths include compromised IAM credentials, overly permissive IAM rules, exposed access keys, and phishing.
In the demonstration, an attacker downloads an object, encrypts it with a customer-provided key, and overwrites the S3 object; users without that key cannot retrieve it normally.
The presenter recommends enabling S3 data events in CloudTrail for sensitive buckets and querying the records for PutObject events and customer-provided encryption settings.
A Resource Control Policy can deny PutObject requests using customer-provided encryption, blocking the demonstrated overwrite method when that behavior is not authorized.

Article Details

Topics: [00:00] S3 ransomware technique and reported targeting
[00:44] Initial access through compromised credentials and excessive IAM permissions
[08:58] Detecting S3 PutObject activity through CloudTrail data events and Athena
[10:39] Preventing unauthorized customer-provided encryption with a Resource Control Policy
Demonstration of encrypting and overwriting S3 objects with a customer-provided key

MITRE ATT&CK

T1486 · Data Encrypted for ImpactThe demonstrated ransomware method encrypts S3 objects with an attacker-held customer-provided key and overwrites them, preventing normal access.

Summary

Key points

Article Details

MITRE ATT&CK

Related Articles