Ransomware Groups Targeting Cloud Backup Systems and Credentials

Ransomware groups are increasingly shifting their focus from traditional on-premises systems to cloud infrastructure, specifically targeting backup systems and cloud management credentials. Google’s Security Chief highlighted that attackers are compromising backup data, deleting routines, and altering permissions to prevent recovery and increase ransom leverage, with compromised credentials and misconfigurations being the leading causes of breaches. The threat is particularly acute in regions with uneven digital maturity, such as APAC, where inconsistent security practices make organizations more vulnerable. Investigations have revealed that ransomware actors are now stealing AWS keys to gain access to cloud environments, further complicating incident response and expanding the attack surface. Both Google and security vendors are urging organizations to adopt isolated recovery environments and strengthen cloud credential management to mitigate these evolving threats.