Loading story…
Ransomware operators are increasingly integrating native Amazon Web Services (AWS) features, such as S3 buckets, compute snapshots, and cloud backup systems, into their attack toolkits to maximize the impact of their campaigns. Recent research highlights that these groups are not only targeting misconfigured cloud storage but are also leveraging built-in AWS capabilities—like encryption management and key rotation—to delete, overwrite, or render data unrecoverable, often bypassing traditional security controls. The attackers exploit customer-provided keys and other advanced cloud-native mechanisms to assert control over cryptographic protections, making recovery efforts significantly more difficult for victims.
Trend Micro researchers have identified at least five distinct ransomware variants that exploit AWS S3 misconfigurations for irreversible data destruction. Security experts note that while S3-focused attacks have been observed for years, the current trend marks a shift toward systematic abuse of cloud-native features for extortion. This evolution in tactics underscores the need for organizations to strengthen cloud security postures, particularly around key management, backup strategies, and monitoring for suspicious use of native cloud services.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Multiple reports describe the emergence of ransomware variants designed to abuse native AWS capabilities and misconfigured S3 environments, enabling attackers to encrypt or destroy cloud-stored data. The coverage highlights five cloud-native variants and a shift from traditional endpoint-focused ransomware toward direct cloud resource targeting.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcescworld.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware attacks are increasingly shifting from traditional on-premises systems to cloud environments, with attackers exploiting misconfigured cloud storage, such as Amazon S3 buckets, and leveraging stolen credentials to compromise business-critical data. Trend Micro research highlights five S3 ransomware variants and details how attackers use native cloud features to delete, overwrite, or exfiltrate data, often evading traditional security tools. Meanwhile, a study of Australian individuals and SME owners reveals that ransomware victims frequently receive multiple ransom demands, with SMEs more likely to pay and experience repeat attacks, often affecting both work-issued and personal devices used for business. The human element remains a significant vulnerability, and the spread of ransomware within organizations underscores the need for both technological and behavioral defenses. The evolving ransomware landscape also includes sophisticated attack paths, such as lateral movement using compromised credentials, targeting backup servers, and exfiltrating sensitive files before deploying ransomware, as seen in recent incidents involving the Lynx ransomware. These developments highlight the necessity for organizations to implement robust cloud security measures, improve detection and response capabilities, and educate users about the risks of paying ransoms. The convergence of cloud-focused ransomware tactics and the persistent targeting of individuals and small businesses demonstrates the broadening scope and impact of ransomware threats in the current cybersecurity environment.
Jul 12, 2026
Ransomware groups are increasingly shifting their focus from traditional on-premises systems to cloud infrastructure, specifically targeting backup systems and cloud management credentials. Google’s Security Chief highlighted that attackers are compromising backup data, deleting routines, and altering permissions to prevent recovery and increase ransom leverage, with compromised credentials and misconfigurations being the leading causes of breaches. The threat is particularly acute in regions with uneven digital maturity, such as APAC, where inconsistent security practices make organizations more vulnerable. Investigations have revealed that ransomware actors are now stealing AWS keys to gain access to cloud environments, further complicating incident response and expanding the attack surface. Both Google and security vendors are urging organizations to adopt isolated recovery environments and strengthen cloud credential management to mitigate these evolving threats.
Jun 29, 2026
Attackers who obtain AWS programmatic credentials with broad Amazon S3 permissions can overwrite objects using **server-side encryption with customer-provided keys** (`SSE-C`). The attackers control the AES-256 keys, which AWS does not store or recover; consequently, organizations cannot decrypt the replaced objects without the original attacker-held keys. The technique can be paired with a ransom note and a seven-day bucket lifecycle deletion policy, creating both an extortion mechanism and a risk of permanent data loss. Organizations should collect Amazon S3 data events in AWS CloudTrail and alert on successful `PutObject` activity specifying SSE-C/AES256 encryption, especially where the behavior is new for an IAM principal or bucket. Defenses include enabling S3 versioning to preserve recoverable object versions, enforcing least-privilege IAM and restrictive bucket policies, and monitoring changes to lifecycle configurations. S3 default server-side encryption should be configured as appropriate, but it does not eliminate the risk from authorized requests that explicitly supply attacker-controlled SSE-C keys.
Sep 9, 2026