Massive Cyber Attack on AWS: 230M Targets Scanned

Attackers exploited publicly accessible .env files containing sensitive credentials to gain unauthorized access to multiple cloud environments. 

By leveraging exposed environment variables, long-lived credentials, and a lack of least privilege, attackers established infrastructure within victim organizations’ AWS environments to scan for additional targets. 

It resulted in the exfiltration of sensitive data from cloud storage containers and subsequent extortion attempts, demonstrating the exploitation of misconfigured cloud environments and the potential for significant financial loss. 

Threat actors exploited exposed AWS IAM access keys from publicly accessible .env files to gain initial access to cloud environments. 

Using these keys, attackers performed discovery actions on IAM, STS, S3, and SES services by leveraging GetCallerIdentity to verify credentials and gather information about the AWS account and user. 

Subsequently, they enumerated IAM users and S3 buckets for potential lateral movement and data exfiltration targets and also assessed SES capabilities for potential email-based attacks, highlighting the service as a vector for phishing campaigns. 

Attackers leveraged an IAM role with limited permissions to create a new role with administrator access, escalating privileges, and subsequently deploying multiple Lambda functions across regions, each designed to scan millions of domains for exposed .env files containing credentials. 

Successful credential retrieval resulted in storage within a threat actor-controlled S3 bucket. The attackers primarily targeted domains referencing Mailgun, likely for subsequent phishing campaigns. 

Evidence indicates a highly automated operation involving multiple compromised accounts, leveraging misconfigured cloud environments for credential harvesting. 

They exfiltrated data from S3 buckets using the S3 Browser, detected via CloudTrail logs. Post-exfiltration, a ransom note was uploaded to the emptied bucket, demanding payment to prevent data sales. 

A subsequent investigation revealed a publicly exposed S3 bucket containing stolen .env files with sensitive credentials, including AWS access keys, PayPal OAuth tokens, and GitHub secrets, were likely leveraged for further attacks. The exposure of .env files stemmed from victim misconfigurations, not vendor vulnerabilities. 

According to Unit 42 researchers, IAM credentials that had been compromised were used by threat actors in order to gain access to S3 buckets and steal data from them. 

Network analysis revealed VPN and Tor usage, with subsequent pivoting to ISP-assigned IP addresses, while cost and usage reports identified anomalous GetObject and DeleteObject activity. 

To mitigate risks, organizations should implement IAM roles, enforce least privilege, disable unused regions, enable comprehensive logging (including CloudTrail and S3 access logs), and establish robust monitoring processes with appropriate alerts. 

An extensive extortion campaign compromised cloud environments by exploiting exposed environment variable files (.env) within victim organizations’ web applications. 

The attackers targeted over 110,000 domains, collecting 90,000+ leaked variables, including cloud service credentials and social media account details. To maintain anonymity, the attackers used Tor exit nodes and obfuscated their locations with VPS and VPN endpoints. 

While a legitimate tool (gargs_linux) was used within a Lambda function, the campaign also utilized malicious infrastructure with a specific SHA256 hash for identification. 

Also Read:

GitHub AI Copilot: Auto-Detect and Fix Code Vulnerabilities Instantly

See more