Ankura CTIX FLASH Update - August 20, 2024

Ransomware/Malware Activity

Attackers Exploit Public ".env" Files to Breach Cloud Accounts in Large Scale Extortion Campaign

Researchers have identified an extortion campaign's cloud operation that compromised multiple victim organizations' AWS environments by leveraging exposed environment variable (.env) files containing sensitive variables. The campaign's attack infrastructure scanned 110,000 domains which uncovered 7,000 variables belonging to organizations' cloud services. The success of this attack campaign relied on misconfigurations in victim organizations that exposed their ".env" files within web applications. Environment files often define configuration variables used within applications that often contain secrets such as access keys, API keys, and database login information. In this campaign, attackers utilized exposed AWS Identity and Access Management (IAM) access keys obtained from the publicly accessible ".env" files. Once initially compromised,