The latest Palo Alto Networks Unit 42 Cloud Threat Report found that sensitive data is found in 66% of cloud storage buckets. This data is vulnerable to ransomware attacks. The SANS Institute recently reported that these attacks can be performed by abusing the cloud provider’s storage security controls and default settings.
“In just the past few months, I have witnessed two different methods for executing a ransomware attack using nothing but legitimate cloud security features,” warns Brandon Evans, security consultant and SANS Certified Instructor. Halcyon disclosed an attack campaign that leveraged one of Amazon S3’s native encryption mechanisms, SSE-C, to encrypt each of the target buckets. A few months prior, security consultant Chris Farris demonstrated how attackers could perform a similar attack using a different AWS security feature, KMS keys with external key material, using simple scripts generated by ChatGPT. “Clearly, this topic is top-of-mind for both threat actors and researchers alike,” notes Brandon.
To address cloud ransomware, SANS recommends organizations to:
To learn more, watch Brandon’s webcast, “The Cloud Won’t Save You from Ransomware: Here’s What Will”, by visiting https://www.sans.org/webcasts/cloud-wont-save-you-from-ransomware-heres-what-will/
Interested in additional tactics for mitigating attacks in the Big 3 cloud providers? Check out Brandon’s course, SEC510: Cloud Security Controls and Mitigations at SANS 2025 in Orlando or Live Online this April. This course is also available with Brandon later in the year in Baltimore, MD in June or Washington, DC in July.
