To succeed, attackers typically look for S3 buckets that have: versioning disabled ( so old versions can’t be restored), object-lock disabled ( so files can be overwritten or deleted), wide write permissions (via mis-configured IAM policies or leaked credentials), and hold high-value data (backup files, production config dumps).
Once inside, the attackers try to impose a “complete and irreversible lockout” of data, which may involve encryption objects with keys inaccessible to the victim, deleting backups, and scheduling key deletion so AWS and the customer can’t recover the data.
“This research is a systematic and theoretical threat modelling exercise on how an attacker might encrypt and ransom an AWS environment within an account boundary–something we’ve talked about over the last 10 years,” said Trey Ford, chief strategy and trust officer at Bugcrowd.
Weaponizing cloud encryption and key management
Trend Micro has identified five S3 ransomware variants that increasingly exploit AWS’s built-in encryption paths. One abuses default AWS-managed KMS keys (SSE-KMS) by encrypting data with an attacker-created key and scheduling that key for deletion. Another uses customer-provided keys (SSE-C), where AWS has no copy, making recovery impossible. The third one exfiltrates S3 bucket data (with no versioning) and deletes the originals.
The final two variants go deeper into key management infrastructure. One relies on imported key material (BYOK), letting attackers encrypt data and then destroy or expire the imported keys. The other abuses AWS’s External Key Store (XKS), where key operations happen outside AWS, which means that if attackers control the external key source, neither the customer nor AWS can restore access. Together, the techniques reveal that attackers are using AWS itself as the encryption mechanism.
“I can’t recall having seen this done in the wild,” Ford added. “This specifically targets the use of external or customer-provided keys (SSE-C or XKS, respectively) to assert control over key management for the cryptography used in storage.”
