AWS S3 Ransomware: SSE-C Encryption (Codefinger)
Client deliverables and backups at a professional-services firm are silently re-encrypted overnight using a legitimate AWS storage feature. No malware runs on any host. Working through CloudTrail, piece together how stolen service-account keys were used to install a countdown clock and lock every object behind a key only the attacker holds.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify the account used by the attacker
15The first unauthorized API call came from an address outside the organization. Working through the CloudTrail audit, identify the IAM user identity behind that activity.
Find the primary bucket targeted
15Two S3 buckets were attacked. Identify the one that received both the re-encrypted objects and the ransom note.
Confirm the first attacker egress IP
15The initial credential-validation and lifecycle-configuration calls share one source IP. Identify that address.
Locate the countdown mechanism
20Before a single object was re-encrypted, the attacker called an API that sets a hard deadline for automatic object deletion. Identify that API call by its CloudTrail eventName.
Characterize the encryption method
20The attacker did not use malware to encrypt files. They used a native AWS feature to write objects that no one but them can read. Identify the request header that distinguishes malicious PutObject events from normal ones in this account.
Map the initial access to MITRE
15The attacker did not exploit a vulnerability or phish a human. They obtained the key material from static configuration. Identify the MITRE ATT&CK sub-technique that describes harvesting credentials stored in files.
Classify the impact technique
15Map the re-encryption action itself to its MITRE ATT&CK technique.
7 tasks · 115 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.