AWS Ransomware

What it is

A DFIR.ch incident write-up of a real AWS S3 ransomware case (activity dated January–February 2024). The value beyond the summary is the concrete CloudTrail event sequence a defender can alert on, and the ~18-day dwell time between reconnaissance and destruction.

How it works

The attacker worked entirely through the AWS API against an account they already had credentials for. The recon-to-destruction chain, all visible in CloudTrail:

flowchart LR
  A[Recon Jan 18<br/>GetSendQuota, ListBuckets] --> B[Enumerate bucket safety<br/>versioning/replication/logging]
  B --> C[DeleteBucket Feb 5<br/>all buckets erased]
  C --> D[Ransom note + fake<br/>recovery binary left behind]

Before deleting, the attacker checked whether recovery would be possible — reading GetBucketVersioning (versioning was not enabled), GetBucketReplication, GetBucketObjectLockConfiguration, GetBucketLogging, GetBucketRequestPayment, and GetAccelerateConfiguration. Only then did they issue DeleteBucket. The claim that data was "downloaded and backed up" is unsupported by the logs — the note is extortion pressure, and the bundled recovery binary is a scam (as the summary states).

Preconditions / Affected

Any AWS account where an attacker has obtained credentials with S3 and SES read access plus s3:DeleteBucket. Buckets without versioning or Object Lock are unrecoverable after deletion — that is exactly what the attacker verified before acting.

What to do

• Alert on the CloudTrail events above. The recon pair GetSendQuota + ListBuckets is an early signal; the GetBucket* configuration reads immediately preceding DeleteBucket are a strong pre-destruction indicator. The post points to an Invictus-IR CSV of noteworthy cloud-ransomware CloudTrail events for building this monitoring.
• Enable S3 Versioning and Object Lock so DeleteBucket/object deletion is recoverable — the absence of versioning is precisely what made this destructive.
• Ignore the recovery binary. strace shows it only clock_nanosleeps for random durations and reads fabricated account/file details from a bundled aws.txt; it performs no restore. Do not run it or pay.
• Note the 18-day gap (recon Jan 18 → deletion Feb 5): there is a real detection window here if the recon events are monitored.

Caveats

The exfiltration claim is not corroborated by the logs shown; the authors treat it as bluff. The binary analysis is reproduced by the authors via strace and matches a variant uploaded to VirusTotal (submitted Jan 29, 2024, from France), but the "downloaded your data" assertion remains the attacker's unverified word.