Next-Gen Ransomware Targets AWS S3: Five Cloud-Native Variants Exploit Misconfigurations for Irreversible Data Destruction

According to Trend Research, ransomware operators are shifting from traditional systems to cloud-native environments, with Amazon S3 emerging as a high-value target. The report outlines five S3 ransomware variants, combining real-world incidents and proof-of-concept attack vectors that could shape future campaigns, including misconfigurations such as lack of versioning, object lock, or MFA delete.

Variant 1 involves KMS key deletion, where a world-readable CMK is created to encrypt objects and then deleted, leaving a seven-day countdown before permanent data loss. Variant 2 uses SSE-C, with AWS not storing the keys and only the HMAC logged, meaning recovery is not possible if attackers control the encryption keys. Variant 3 combines exfiltration with deletion, where data is stolen and then removed from the bucket, with no backups or versioning to reverse the damage.

Variant 4 proposes imported KMS key material (BYOK) that is used to encrypt data and allowed to expire, destroying the key’s usefulness, and Variant 5 examines external key store abuse via the XKS proxy to encrypt data outside AWS control.