Monday,
January 20, 2025

🥖 Palette Cleanser

Welcome back eager beaver,

I've got red meat for you today! Well, since you are a beaver, I guess it's brown bark. 🤷 On 8th January, the famous VX Underground account tweeted, "We're witnessing the evolution of ransomware... Threat Actors abusing the Amazon Key Management Service (KMS) to encrypt company AWS buckets (or any cloud provider)." This prompted a 100+ message thread on the Cloud Security Forum Slack.

A week later Forbes published the fud-ilicious "New Amazon Ransomware Attack—‘Recovery Impossible’ Without Payment". Much bad, many scare. AWS, being a responsible cloud provider immediately followed with its helpful guidance on preventing said badness.

While this makes for great popcorn eating content, and certainly there's reason to be more vigilant now that threat actors are actively executing S3 ransomware, this is all hardly new. Spencer Gietzen discussed the problem in 2019. Harsh Varagiya pointed to external key stores (XKS) as a means to make attacks more effective in October last year, as did Chris Farris in November. Halcyon published their goodies in January and Kat Traxler has a long-standing whitepaper on the topic. It might be 2025 but we are still fighting 2019 problems.

In lighter news, you can now sign in up to five different identities simultaneously in a single web browser in the AWS Management Console. Enjoy the extra tabs you definitely needed.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

Bonus: How to "bypass" honeypots in AWS

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

Dessert is made by robots, for those that enjoy the industrial content.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

    No resource updates this week.

🎮 Amazon Linux vulnerabilities

📺 AWS Security Bulletins

YouTube Twitter LinkedIn

Crafted with ❤️ by Plerion. We simplify cloud security.