Loading story…
Ransomware attacks are increasingly shifting from traditional on-premises systems to cloud environments, with attackers exploiting misconfigured cloud storage, such as Amazon S3 buckets, and leveraging stolen credentials to compromise business-critical data. Trend Micro research highlights five S3 ransomware variants and details how attackers use native cloud features to delete, overwrite, or exfiltrate data, often evading traditional security tools. Meanwhile, a study of Australian individuals and SME owners reveals that ransomware victims frequently receive multiple ransom demands, with SMEs more likely to pay and experience repeat attacks, often affecting both work-issued and personal devices used for business. The human element remains a significant vulnerability, and the spread of ransomware within organizations underscores the need for both technological and behavioral defenses.
The evolving ransomware landscape also includes sophisticated attack paths, such as lateral movement using compromised credentials, targeting backup servers, and exfiltrating sensitive files before deploying ransomware, as seen in recent incidents involving the Lynx ransomware. These developments highlight the necessity for organizations to implement robust cloud security measures, improve detection and response capabilities, and educate users about the risks of paying ransoms. The convergence of cloud-focused ransomware tactics and the persistent targeting of individuals and small businesses demonstrates the broadening scope and impact of ransomware threats in the current cybersecurity environment.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing how ransomware actors increasingly target AWS cloud-native assets such as S3 buckets, snapshots, databases, container registries, and backup systems. The report emphasized that compromising or deleting these resources can block recovery and increase pressure on victims to pay.
The DFIR Report publicly documented the nine-day March 2025 intrusion, detailing the attack path, persistence, exfiltration, infrastructure, and ransomware deployment. The publication provided technical insight into the Lynx ransomware operation.
On the final day of the roughly nine-day intrusion, the actor accessed backup servers, deleted Veeam backup jobs, and deployed Lynx ransomware across multiple backup and file servers via RDP. The report assessed the time from initial access to ransomware as about 178 hours.
During the intrusion, the actor changed RDP source infrastructure between two IP addresses attributed to Railnet LLC, described in the report as a front for the Russia-based bulletproof hosting provider Virtualine. The same client hostname was maintained across the infrastructure change.
Midway through the intrusion, the actor gathered sensitive data from multiple network shares, compressed it with 7-Zip, and exfiltrated it using the temporary file-sharing service temp.sh. This established a data-theft phase before ransomware deployment.
During the intrusion, the attacker relied heavily on SoftPerfect Network Scanner for network discovery and lateral movement. They later downloaded NetExec to conduct SMB password spraying and enumeration over port 445.
Within minutes of initial access, the actor used a separate compromised domain administrator account to RDP into a domain controller. They created multiple look-alike Active Directory accounts, added them to privileged groups, and set passwords to never expire for persistence.
In early March 2025, an attacker accessed an internet-exposed host through RDP using pre-compromised valid credentials. The report found no evidence of brute force or credential stuffing during the initial compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceaic.gov.au
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators are increasingly integrating native Amazon Web Services (AWS) features, such as S3 buckets, compute snapshots, and cloud backup systems, into their attack toolkits to maximize the impact of their campaigns. Recent research highlights that these groups are not only targeting misconfigured cloud storage but are also leveraging built-in AWS capabilities—like encryption management and key rotation—to delete, overwrite, or render data unrecoverable, often bypassing traditional security controls. The attackers exploit customer-provided keys and other advanced cloud-native mechanisms to assert control over cryptographic protections, making recovery efforts significantly more difficult for victims. Trend Micro researchers have identified at least five distinct ransomware variants that exploit AWS S3 misconfigurations for irreversible data destruction. Security experts note that while S3-focused attacks have been observed for years, the current trend marks a shift toward systematic abuse of cloud-native features for extortion. This evolution in tactics underscores the need for organizations to strengthen cloud security postures, particularly around key management, backup strategies, and monitoring for suspicious use of native cloud services.
Jun 29, 2026
Ransomware attacks continue to pose a significant threat to organizations, with recent surveys indicating that paying the ransom does not guarantee successful data recovery. According to Hiscox’s Cyber Readiness Report, only 60% of companies that paid a ransom were able to recover all or part of their data, while 40% lost their data despite payment. The technical sophistication of ransomware operators varies, with established groups more likely to provide functional decryptors, but many victims still face flawed encryption or unresponsive attackers. Additionally, the frequency of ransomware incidents has surged, with reports showing a near tripling of cases year-over-year in early 2025, and a majority of victims experiencing data theft even after paying ransoms. The ransomware landscape has evolved from high-volume, opportunistic attacks to a "big game hunting" model, where adversaries selectively target organizations with the most to lose and the greatest ability to pay. New criminal syndicates such as Spoiled Scorpius (RansomHub) and Howling Scorpius (Akira) are conducting sophisticated, long-term campaigns against high-value targets, often employing multi-extortion tactics that combine data encryption with threats of public exposure. This strategic shift has transformed ransomware from a purely IT issue into a critical business continuity threat, requiring organizations to adopt new defensive strategies and prepare for more calculated, high-impact attacks.
Jun 29, 2026
Ransomware groups are increasingly shifting their focus from traditional on-premises systems to cloud infrastructure, specifically targeting backup systems and cloud management credentials. Google’s Security Chief highlighted that attackers are compromising backup data, deleting routines, and altering permissions to prevent recovery and increase ransom leverage, with compromised credentials and misconfigurations being the leading causes of breaches. The threat is particularly acute in regions with uneven digital maturity, such as APAC, where inconsistent security practices make organizations more vulnerable. Investigations have revealed that ransomware actors are now stealing AWS keys to gain access to cloud environments, further complicating incident response and expanding the attack surface. Both Google and security vendors are urging organizations to adopt isolated recovery environments and strengthen cloud credential management to mitigate these evolving threats.
Jun 29, 2026