Unit 42 researchers have uncovered a highly intricate cyber operation targeting cloud systems, resulting in significant extortion and manipulation of various organizations.
This extensive attack, aimed at AWS, compromised over 230 million distinct cloud environments. The attackers exploited unprotected environment variable (.env) files, which often contain sensitive information like access codes for various services and programs.
By accessing these .env files, the perpetrators gained unauthorized entry into the victims’ systems, allowing them to further infiltrate and explore the networks.
Technical Overview
The attackers deployed automated tools to probe millions of domains, focusing on unprotected .env files with crucial information. Once inside, they performed detailed reconnaissance using AWS API calls, such as GetCallerIdentity, ListUsers, and ListBuckets.
They then escalated their privileges by creating new IAM roles with full administrative access, showcasing their deep understanding of AWS IAM components. Subsequently, they deployed malicious Lambda functions designed to conduct recursive searches for more .env files across multiple AWS regions, particularly targeting Mailgun credentials for a large-scale phishing operation.
The campaign’s scale was evident as the attackers accessed .env files from over 110,000 domains and targeted more than 230 million unique endpoints. The operation concluded with the attackers exfiltrating data into S3 buckets they controlled.
Implications and Recommendations
This sophisticated attack underscores the critical need for robust IAM policies, vigilant monitoring of cloud activities, and stringent security practices for configuration files to prevent unauthorized access and data loss in cloud environments.
Palo Alto’s research revealed that the initial IAM credentials did not grant full administrative access but allowed the creation of new IAM roles and attachment of policies. This insight into the attackers’ methods highlights the importance of comprehensive security measures.
The attackers used S3 Browser to make specific API calls, avoiding object-level logging. However, Cost and Usage Reports could detect anomalies related to GetObject and DeleteObject operations.
After exfiltrating and deleting data, the attackers left ransom notes in the emptied S3 buckets, demanding payment to prevent data leaks and potentially restore the deleted information. These notes were sometimes sent to targeted company shareholders via email.
The campaign also extended beyond cloud services, compromising social media login credentials and revealing various infrastructure details. A tactical misstep by the attackers, who used both Tor nodes and VPN clients, potentially exposed their locations in Ukraine and Morocco.
To mitigate risks from such advanced attacks, organizations should disable unused AWS regions, maintain robust logs with a 90-day retention period, and employ Amazon GuardDuty. Adopting least privilege and temporary credentials, along with developing tailored alerting systems, is crucial for enhancing security. Implementing a multi-layered defense strategy, continuous monitoring, and regular security audits are essential to protect against sophisticated cyber threats.
