230 million cloud environments under massive cyber attack on AWS

TLDR:

• A massive cyber attack targeted over 230 million unique cloud environments on AWS
• Attackers exploited exposed .env files containing critical information to gain unauthorized access

A complex large-scale cyber attack campaign was discovered by Unit 42 researchers, targeting over 230 million unique cloud environments on AWS. The attackers exploited .env files containing confidential data to gain unauthorized entry into victims’ systems. They then carried out extensive reconnaissance using AWS API calls and deployed malicious Lambda functions to perform recursive scans for more .env files. The attackers exfiltrated data into S3 buckets and demanded ransom to prevent data leaks.

Proper security measures such as implementing sturdy IAM policies, monitoring cloud activities, and employing Amazon GuardDuty are crucial in mitigating vulnerabilities from such advanced attack campaigns. Companies should also adopt the least privilege and temporary credentials preference and develop custom alerting systems suited to their usage pattern within AWS.

It is important for organizations to disable unused AWS regions, maintain robust logs, and continuously monitor cloud environments to prevent cyber attacks. By implementing a multi-layered defense system and conducting periodic security audits, vulnerabilities from advanced attack campaigns can be effectively mitigated.