#Ransomware threat actors are increasingly abusing AWS's Server-Side Encryption (SSE-C) to encrypt S3 buckets without needing to drop malware. Most recently a TA known as #Codefinger is using this technique.
🕵 Make sure you're monitoring S3 and encryption activity via CloudTrail & GuardDuty.
https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c
If you're in, or near #Singapore, and need to level up your #CloudForeniscs skills, I'll be teaching the SANS Institute #FOR509 #CloudForensics class from the 11th March.
📝 Registration: https://www.sans.org/cyber-security-training-events/secure-singapore-2024/
🧐 Course Info: https://sans.org/for509
Join me for the updated version of the SANS Institute #FOR509 #CloudForensics class in #Canberra Australia next month.
📝 Registration: https://www.sans.org/cyber-security-training-events/offensive-ops-australia-2023/
🤔 What's New: https://m.youtube.com/watch?v=6Xkwt3YzquE&feature=youtu.be
If you're using any Enterprise licence with #M365 your log retention should now be 180 days by default, at a minimum, plus you now get the "MailItemsAccessed" events to track individual email access.
No news on those using the Business Standard licence types 🙄
#DFIR #CloudForensics #FOR509
https://www.microsoft.com/en-us/security/blog/2023/10/18/expanding-audit-logging-and-retention-within-microsoft-purview-for-increased-security-visibility/
Since our announcement in July 2023, we have made significant efforts to enhance the access of Microsoft Purview's audit logging. This ongoing work expands accessibility and flexibility to cloud security logs. Read about the additional updates coming to Microsoft Purview Audit in the coming weeks.
Looks like Pizza Hut Australia have started to notify impacted customers of their recent cyber breach.
The threat actor's initial compromise was via an AWS account, are you ready to investigate an AWS Breach?
#CloudForensics #DFIR #FOR509
The #BlackCat / #ALPHV #ransomware group have been observed using their #Sphynx loader to target Azure Storage accounts once they steal access keys.
#CloudForensics #DFIR #FOR509
Attached: 1 image The threat actors were able to gain access to the customer's Azure portal, where they obtained the Azure key required to access the storage account programmatically. The adversary encoded the keys using base-64 and inserted them into the ransomware binary with execution command lines as shown. The “-o” argument targets an Azure Storage account name and access key, and the same binary was executed multiple times to target 39 unique Azure Storage Accounts, resulting in successful encryption.
I'm running the #FOR509 #CloudForensics course in 🇦🇺Sydney this May, both in-person and virtual.
The new class version includes a #GCFR certification and our Day 6 Capstone Challenge with a multi-cloud #DFIR incident to investigate.
To Register: sans.org/u/1prs
FOR509 Course Info: for509.com/course
Josh Lemon
13reak 
