Loading story…
Wiz found that S3-compatible object-storage offerings from Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean can differ substantially from Amazon S3 in public-bucket behavior, IAM semantics, access-key handling, encryption, logging, and API implementation. The assessment warns that application teams may mistake S3 API compatibility—including Cloudflare R2's S3-compatible interface—for equivalent security guarantees and least-privilege controls.
Across the providers reviewed, Wiz identified inconsistent protections against exposed credentials, limited granular key restrictions and data-plane logging in some services, and differences in anonymous bucket and object-listing behavior; DigitalOcean was noted as an exception where public-bucket object listing may be possible. The report also highlighted cross-provider risks from bucket namesquatting and reusable presigned URLs, urging organizations to validate each provider's authorization, public-access, audit, and credential-control behavior rather than relying on AWS S3 assumptions.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Wiz assessed S3-compatible object storage from Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean, finding that API compatibility with AWS S3 did not provide equivalent public-access controls, credential protections, IAM semantics, logging, or least-privilege capabilities. The analysis also identified cross-provider risks including bucket namesquatting and reusable presigned URLs, and documented provider-specific API behaviors that could produce unsafe assumptions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers who obtain AWS programmatic credentials with broad Amazon S3 permissions can overwrite objects using **server-side encryption with customer-provided keys** (`SSE-C`). The attackers control the AES-256 keys, which AWS does not store or recover; consequently, organizations cannot decrypt the replaced objects without the original attacker-held keys. The technique can be paired with a ransom note and a seven-day bucket lifecycle deletion policy, creating both an extortion mechanism and a risk of permanent data loss. Organizations should collect Amazon S3 data events in AWS CloudTrail and alert on successful `PutObject` activity specifying SSE-C/AES256 encryption, especially where the behavior is new for an IAM principal or bucket. Defenses include enabling S3 versioning to preserve recoverable object versions, enforcing least-privilege IAM and restrictive bucket policies, and monitoring changes to lifecycle configurations. S3 default server-side encryption should be configured as appropriate, but it does not eliminate the risk from authorized requests that explicitly supply attacker-controlled SSE-C keys.
Sep 9, 2026
AWS guidance highlights **Resource Control Policies (RCPs)** as organization-level guardrails that constrain resource policies, including access granted to principals outside an AWS Organization. RCPs complement Service Control Policies by applying to external principals, helping prevent attacker-controlled accounts from bypassing internal SCP restrictions. They can enforce data-perimeter standards for cross-account access, IAM role assumption, OIDC federation, and transport security, alongside controls such as VPC Block Public Access and centrally managed root access. For Amazon S3, AWS supports bucket and access-point policies using `s3:TlsVersion` and `aws:SecureTransport` to require stronger encryption in transit, including TLS 1.3 where needed; AWS service API endpoints require TLS 1.2 or later by default. Organizations should use IAM Access Analyzer and access logs to identify dependencies, test RCPs in sandbox accounts, and roll them out progressively because RCPs lack an audit-only mode and can generate generic `AccessDenied` errors. Legacy TLS clients can be isolated behind CloudFront, while S3 Access Points allow stricter TLS requirements for selected access paths to the same data.
Sep 3, 2026
Ransomware operators are increasingly integrating native Amazon Web Services (AWS) features, such as S3 buckets, compute snapshots, and cloud backup systems, into their attack toolkits to maximize the impact of their campaigns. Recent research highlights that these groups are not only targeting misconfigured cloud storage but are also leveraging built-in AWS capabilities—like encryption management and key rotation—to delete, overwrite, or render data unrecoverable, often bypassing traditional security controls. The attackers exploit customer-provided keys and other advanced cloud-native mechanisms to assert control over cryptographic protections, making recovery efforts significantly more difficult for victims. Trend Micro researchers have identified at least five distinct ransomware variants that exploit AWS S3 misconfigurations for irreversible data destruction. Security experts note that while S3-focused attacks have been observed for years, the current trend marks a shift toward systematic abuse of cloud-native features for extortion. This evolution in tactics underscores the need for organizations to strengthen cloud security postures, particularly around key management, backup strategies, and monitoring for suspicious use of native cloud services.
Jun 29, 2026