Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud Environments

Summary: Unit 42 researchers documented an extortion campaign that used exposed .env files to obtain cloud credentials, then set up attack infrastructure inside victims' AWS environments and scanned more than 230 million unique targets for sensitive information. The operation targeted 110,000 domains and surfaced over 90,000 unique variables, of which 7,000 belonged to organizations' cloud services and 1,500 traced back to social media accounts; attackers exfiltrated data from cloud storage containers and left ransom notes rather than encrypting it.

Bottom line: The attackers escalated from a single exposed IAM key to an administrator role named lambda-ex and deployed a scanning Lambda function into every enabled region within a second, all in under a minute of scripted activity. The entry point was not a cloud provider flaw but victim organizations publishing .env files containing hard-coded access keys, SaaS API keys, and database logins to the public internet.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related