Loading story…
Ransomware groups are increasingly shifting their focus from traditional on-premises systems to cloud infrastructure, specifically targeting backup systems and cloud management credentials. Google’s Security Chief highlighted that attackers are compromising backup data, deleting routines, and altering permissions to prevent recovery and increase ransom leverage, with compromised credentials and misconfigurations being the leading causes of breaches. The threat is particularly acute in regions with uneven digital maturity, such as APAC, where inconsistent security practices make organizations more vulnerable. Investigations have revealed that ransomware actors are now stealing AWS keys to gain access to cloud environments, further complicating incident response and expanding the attack surface. Both Google and security vendors are urging organizations to adopt isolated recovery environments and strengthen cloud credential management to mitigate these evolving threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Varonis published research describing a ransomware intrusion pattern in which attackers steal AWS access keys to expand access and progress their operations in cloud environments. The reference provided does not include earlier dated milestones, so this event is anchored to the publication date.
Google Cloud CISO Phil Venables warned that ransomware groups increasingly target backup infrastructure, emphasizing that organizations should harden and isolate backups as part of resilience planning. The reference does not describe a specific incident date, so the event is anchored to the article publication date.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware attacks are increasingly shifting from traditional on-premises systems to cloud environments, with attackers exploiting misconfigured cloud storage, such as Amazon S3 buckets, and leveraging stolen credentials to compromise business-critical data. Trend Micro research highlights five S3 ransomware variants and details how attackers use native cloud features to delete, overwrite, or exfiltrate data, often evading traditional security tools. Meanwhile, a study of Australian individuals and SME owners reveals that ransomware victims frequently receive multiple ransom demands, with SMEs more likely to pay and experience repeat attacks, often affecting both work-issued and personal devices used for business. The human element remains a significant vulnerability, and the spread of ransomware within organizations underscores the need for both technological and behavioral defenses. The evolving ransomware landscape also includes sophisticated attack paths, such as lateral movement using compromised credentials, targeting backup servers, and exfiltrating sensitive files before deploying ransomware, as seen in recent incidents involving the Lynx ransomware. These developments highlight the necessity for organizations to implement robust cloud security measures, improve detection and response capabilities, and educate users about the risks of paying ransoms. The convergence of cloud-focused ransomware tactics and the persistent targeting of individuals and small businesses demonstrates the broadening scope and impact of ransomware threats in the current cybersecurity environment.
Jul 12, 2026
Ransomware operators are increasingly integrating native Amazon Web Services (AWS) features, such as S3 buckets, compute snapshots, and cloud backup systems, into their attack toolkits to maximize the impact of their campaigns. Recent research highlights that these groups are not only targeting misconfigured cloud storage but are also leveraging built-in AWS capabilities—like encryption management and key rotation—to delete, overwrite, or render data unrecoverable, often bypassing traditional security controls. The attackers exploit customer-provided keys and other advanced cloud-native mechanisms to assert control over cryptographic protections, making recovery efforts significantly more difficult for victims. Trend Micro researchers have identified at least five distinct ransomware variants that exploit AWS S3 misconfigurations for irreversible data destruction. Security experts note that while S3-focused attacks have been observed for years, the current trend marks a shift toward systematic abuse of cloud-native features for extortion. This evolution in tactics underscores the need for organizations to strengthen cloud security postures, particularly around key management, backup strategies, and monitoring for suspicious use of native cloud services.
Jun 29, 2026
A global data storage and infrastructure company suffered a destructive ransomware attack orchestrated by the Akira ransomware group, also known as Howling Scorpius. The attack began when an employee was tricked by a fake CAPTCHA on a compromised website, leading to the download of SectopRAT malware. This initial compromise allowed the attackers to establish a foothold, conduct reconnaissance, escalate privileges, and move laterally across the network, ultimately gaining access to domain controllers and cloud resources. Over a 42-day period, the attackers used advanced social engineering and technical tactics to evade detection and prepare for the final stage of the attack. The attackers exploited cloud misconfigurations to destroy backups, crippling the victim's ability to recover data. The use of a CAPTCHA decoy and the targeting of cloud backups highlight evolving ransomware tactics aimed at maximizing operational disruption and ransom leverage. This incident underscores the importance of comprehensive security visibility, robust backup protection, and user awareness to defend against sophisticated, multi-stage ransomware campaigns that blend social engineering with technical exploitation.
Jun 29, 2026