A high-level extortion scheme targeted 110,000 websites by exploiting improperly secured .env files within web applications. The attackers exploited these files to extract AWS IAM access keys, which enabled them to generate new IAM roles and policies with unrestricted permissions.
This privilege escalation allowed them to access, steal, and demand ransom for data stored in cloud environments. These .env files, often containing sensitive data such as API keys, passwords, and database credentials, were prime targets for these cybercriminals.
The attack utilized poorly configured AWS .env files to ransom data from S3 storage buckets. By focusing on over 100,000 domains, the attackers employed automation and advanced knowledge of cloud infrastructure to efficiently compromise and exfiltrate critical information.
This incident highlights the urgent need for robust cloud security practices, including strong authentication measures, access controls, data encryption, secure configuration management, and vigilant monitoring to counter such threats.
Cloud users’ security oversights enabled the attackers to exploit .env files with sensitive credentials, revealing issues like exposed environment variables, persistent credentials, and inadequate least-privilege policies.
The attackers accessed AWS environments and scanned millions of targets, extracting over 90,000 unique variables from .env files. They uncovered sensitive details about cloud services and social media accounts, indicating a broad interest in both organizational and personal data.
The sophisticated cyberattack involved a multi-faceted approach, utilizing virtual private servers, the Tor network, and VPNs to gain unauthorized access to cloud storage. After breaching the system, the attackers exfiltrated data without encryption and left a ransom note in the compromised storage, demanding payment for the stolen information. This complexity underscores the growing sophistication of cyber threats and the critical need for stringent security measures.
The widespread exposure of .env files is being exploited by threat actors to gain unauthorized access to cloud environments. These files often contain sensitive credentials like AWS IAM access keys, which can be used to create elevated IAM roles. Cyble’s threat intelligence platform has detected over 1.4 million exposed .env files since early 2024, revealing the extent of this vulnerability.
Attackers scan for these files on unsecured web applications to obtain the necessary credentials for escalating privileges and compromising cloud resources. Initially, they verified IAM credentials and enumerated existing IAM users and S3 buckets, then created a new IAM role with administrative access. In the execution phase, although they failed to set up an EC2 stack, they successfully created AWS Lambda functions to run a bash script for scanning potential targets.
To prevent such attacks, organizations should avoid committing .env files to version control and use environment variables instead. Additionally, implementing access controls, conducting regular audits, and utilizing secret management tools are essential. The attackers masked their activities using Tor exit nodes, VPS, and VPN endpoints, demonstrating the importance of comprehensive security measures.
