#GolangRansomware

Fake LockBit, Real Damage: Ransomware Samples Abuse Amazon S3 to Steal Data

by

November 5, 2024 at 02:48AM Golang ransomware abuses Amazon S3 Transfer Acceleration to exfiltrate victim files to attacker-controlled buckets, leveraging hard-coded AWS credentials. It disguises itself as LockBit ransomware to manipulate victims. AWS confirmed that this activity violates their policy, leading to account suspensions, highlighting the importance of monitoring cloud security. ### Key Takeaways from … Read more

Fake LockBit, Real Damage: Ransomware Samples Abuse AWS S3 to Steal Data

by

October 16, 2024 at 07:39AM The analyzed Golang ransomware exploits Amazon S3 Transfer Acceleration to exfiltrate files to attacker-controlled buckets, utilizing hard-coded AWS credentials. It mimics LockBit ransomware to manipulate victims. AWS confirmed these actions violated its policies and suspended the implicated account. Monitoring AWS credentials can serve as potential Indicators of Compromise (IOCs). ### … Read more