Christophe Tafani-Dereeper

Add references to S3 ransomware in the wild to existing S3 attack techniques

2

https://www.invictus-ir.com/news/ransomware-in-the-cloud https://dfir.ch/posts/aws_ransomware/ and determine if coverage from current techniques is enough or if we need new ones

VMAccess Extension https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques/#post-132775-_p1el9vu0ltrs Similar to EC2 Instance Connect

New attack technique: Snapshot existing volume and attach to compromised EC2 instance

1

Technique 1 from https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques/#post-132775-_p1el9vu0ltrs

https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/

New EKS attack technique: backdooring the aws-auth configmap

1

required #374

> UNC3944 has also found use of some of the more niche features and applications within Azure to move laterally and conduct data theft. On multiple occasions UNC3944 has [moved...

Azure storage account ransomware

1

https://twitter.com/sophosxops/status/1702051374287007923?s=46&t=qDVaCDKbvXeCu776fKzfgw

https://www.mandiant.com/sites/default/files/2021-11/wp-m-unc2452-000343.pdf