Inside the Massive AWS Cloud Breach: How Exploited .env Files Led to a Global Extortion Campaign

Introduction

In a groundbreaking cyber attack, a sophisticated threat actor launched a large-scale extortion campaign that exploited vulnerabilities in cloud systems. Targeting over 230 million unique cloud environments, the attack leveraged exposed environment variable (.env) files to gain unauthorized access and execute a comprehensive data exfiltration and extortion scheme. This blog provides an in-depth analysis of the attack, detailing the tactics used, the impact on victims, and essential lessons for strengthening cloud security.

Attack Overview

The primary tactic of the attack involved exploiting .env files, which are often overlooked in standard security practices. These files, typically used for storing configuration settings and credentials, were found to contain critical information such as access codes and authentication tokens. The attackers' ability to access these files allowed them to infiltrate systems and escalate their privileges, leading to a widespread and devastating attack.

Technical Analysis

Initial Access and Reconnaissance

The attackers began by deploying automated tools to scan a vast number of domains for exposed .env files. These files, which contained sensitive configuration data, were targeted to breach the systems. The threat actors used a combination of web scraping techniques and API queries to identify and access these files.

Once inside, the attackers performed extensive reconnaissance using AWS API calls. Key operations included:

GetCallerIdentity: Identified the IAM user or role making the API calls.
ListUsers: Retrieved a list of IAM users within the compromised AWS account.
ListBuckets: Listed all S3 buckets in the account, providing insight into stored data and potential exfiltration targets. This reconnaissance phase allowed the attackers to map out the infrastructure and identify critical components and services within the victim's cloud environment.

Privilege Escalation

After gathering initial information, the attackers sought to escalate their privileges. They discovered that the IAM credentials initially used to gain access did not provide full administrative rights. Exploiting this, they created new IAM roles with elevated permissions, allowing them to:

Create New IAM Roles: Enabled them to assign more extensive permissions.
Attach IAM Policies: Granted broader access to various AWS resources. This privilege escalation was critical for their subsequent operations, providing them with the ability to deploy and manage resources across the AWS environment.

Malicious Lambda Function Deployment

With elevated privileges, the attackers deployed malicious AWS Lambda functions. These functions were designed to perform recursive scans across multiple AWS regions, searching for .env files and focusing on credentials that could be used for further attacks. The Lambda functions were programmed to:

Scan for .env Files: The functions retrieved files from compromised domains.
Focus on Mailgun Credentials: Targeted credentials that could be exploited for large-scale phishing campaigns. The attackers' Lambda functions were highly effective, as they accessed .env files from over 110,000 domains and compiled a target list exceeding 230 million unique endpoints.

Data Exfiltration

Data exfiltration was executed by uploading stolen information to S3 buckets controlled by the attackers. They utilized tools like S3 Browser to interact with these buckets, making various API calls such as:

ListBuckets: Identified available buckets for data exfiltration.
GetObject: Retrieved specific objects from the buckets.
DeleteObject: Removed data from the victim's buckets after exfiltration. These operations were designed to avoid detection, bypassing traditional object-level logging mechanisms. However, spikes in GetObject and DeleteObject operations could indicate potential data exfiltration activities.

Figure: Statistics of categorized leaks from .env variables.

Ransom Extortion

After exfiltrating and deleting the data, the attackers uploaded ransom notes to the emptied S3 buckets. These notes demanded payment to prevent the sale of the stolen data and potentially restore the deleted information. The ransom notes typically included:

Threats of Data Sale: Warning that the stolen data would be sold on the dark web if payment was not made.
Payment Instructions: Details on how to pay the ransom, usually in cryptocurrency. The ransom notes were also sent directly to the targeted company's stakeholders via email, increasing the pressure to comply with the demands.

Figure: Ransom note left by the threat actor. Source: Paloalto

Operational Architecture

The attack's operational design underscores the attackers' advanced and methodical approach:

Exploitation of .env Files: The attackers exploited exposed .env files, which often contain sensitive configuration data like API keys and access credentials. These files were found across millions of domains, revealing significant lapses in security practices related to configuration file management. The exposure of these files facilitated unauthorized access to a variety of systems, allowing the attackers to move laterally within the compromised networks.
Advanced AWS Utilization: The attackers demonstrated a profound understanding of AWS services and their capabilities. They effectively utilized AWS Lambda functions to automate the scanning process across multiple regions, searching for additional .env files. This automation extended their reach, enabling them to compromise over 230 million unique endpoints. The attackers also manipulated AWS IAM roles, creating new roles with elevated privileges to gain full administrative control over the cloud resources. This sophisticated use of AWS services not only enabled privilege escalation but also facilitated extensive data exfiltration.
Detection Challenges: The attack illustrated significant challenges in detecting and mitigating such operations. By using tools like S3 Browser, the attackers performed data exfiltration and API calls that could evade traditional object-level logging. Their ability to exfiltrate data without immediate detection highlights the limitations of conventional monitoring mechanisms. The reliance on automated processes and the use of S3 for both data storage and ransom notes further complicated detection and response efforts.

Security Implications and Recommendations

Enhance IAM Policies Least Privilege: Grant the minimum permissions necessary and review IAM roles regularly. MFA: Implement multi-factor authentication for all users, especially those with administrative roles.
Secure Environment Variables Use Secrets Manager: Store sensitive data like API keys in AWS Secrets Manager or Parameter Store instead of .env files. Access Controls: Limit access to configuration files and encrypt sensitive data.
Improve Monitoring and Logging CloudWatch Logs: Use AWS CloudWatch for comprehensive logging and monitor key activities. CloudTrail: Enable AWS CloudTrail to track API calls and changes to IAM roles.
Adopt Secure Development Practices Code Reviews: Conduct regular security reviews of code and dependencies. Update Dependencies: Keep third-party libraries up to date to avoid known vulnerabilities.
Strengthen Incident Response Response Plan: Maintain and test an incident response plan to address and recover from security breaches. Forensics: Use forensic analysis to investigate breaches and improve security.
Educate Employees Training: Provide regular security training on recognizing threats and protecting credentials.
Secure S3 Buckets Access Controls: Apply strict access policies to S3 buckets and ensure data is encrypted.
Monitor Automation Rate Limiting: Implement controls to manage automated tools and prevent abuse.

Tactical Observations

Exploitation of .env Files: The attackers targeted exposed .env files across millions of domains, which contained sensitive credentials like API keys and access tokens. This allowed them to gain unauthorized access to cloud services and further infiltrate victim networks. Their ability to automate this process on such a large scale highlights the significant security risk associated with misconfigured or publicly exposed configuration files.
Automated Reconnaissance and Privilege Escalation: Using automated tools, the attackers scanned over 230 million unique cloud environments to identify vulnerable .env files. Once inside, they elevated their privileges by creating new IAM roles with full administrative rights. This approach demonstrated their deep understanding of AWS IAM and allowed them to gain extensive control over compromised systems.
Malicious Lambda Deployment and Data Exfiltration: The attackers deployed a malicious AWS Lambda function that recursively scanned for additional .env files across multiple AWS regions. This function specifically targeted Mailgun credentials for potential phishing campaigns. They exfiltrated the data to S3 buckets they controlled and then used S3 Browser to extract information, bypassing object-level logging. Ransom notes were subsequently uploaded to the compromised buckets, demanding payment to prevent data leaks.
Operational Security and Technical Artifacts: The use of Tor nodes and VPN clients by the attackers to obscure their locations was partially successful but could have revealed some geographic information. Additionally, the attackers’ public S3 bucket, which contained the stolen .env files, was exposed before being reported and taken down. Their reliance on automated operations and sophisticated cloud infrastructure manipulation underscored the need for vigilant monitoring and strong security measures.

Figure: Image showing potential Tor nodes.

Figure: Image showing potential VPN endpoints. Source: Paloalto

Conclusion

The extensive AWS cloud attack reveals significant vulnerabilities in cloud security practices, specifically regarding the management and protection of .env files. Attackers exploited these files to gain access to over 230 million environments, leveraging their deep understanding of AWS services to escalate privileges and exfiltrate data. The sophistication of the attack, including the use of Lambda functions and targeted scanning, underscores the necessity for organizations to enforce rigorous security measures, such as proper handling of configuration files, robust IAM policies, and proactive monitoring. The incident also illustrates the challenges of detecting such activities, particularly when attackers use tools like S3 Browser that evade traditional logging methods.

To enhance resilience against similar future threats, organizations must prioritize comprehensive security strategies. This includes implementing strict access controls, conducting regular security audits, and employing advanced monitoring solutions to detect and respond to anomalies. Additionally, it is crucial to educate teams on best practices for managing sensitive information and maintaining vigilant oversight of cloud resources. By addressing these areas, organizations can better defend against sophisticated cyberattacks and safeguard their critical assets.