{"id":1169,"date":"2024-12-10T12:44:48","date_gmt":"2024-12-10T12:44:48","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=1169"},"modified":"2024-12-10T12:44:48","modified_gmt":"2024-12-10T12:44:48","slug":"aws-customers-face-massive-breach-amid-alleged-shinyhunters-regroup","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=1169","title":{"rendered":"AWS customers face massive breach amid alleged ShinyHunters regroup"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Terabytes of data belonging to thousands of AWS customers, including customer details, AWS credentials, and proprietary source code, were compromised in a large-scale cyber operation linked to the now-defunct ShinyHunters hacking group.<\/p>\n

Independent cybersecurity researchers, Noam Rotem and Ran Locar, found the operation exploiting vulnerabilities and misconfigurations in a number of public sites to gain unauthorized access to sensitive data.<\/p>\n

\u201cWe have identified a significant operation that scanned millions of websites, exploiting vulnerabilities in improperly configured public sites,\u201d said researchers from vpnMentor, the cybersecurity research firm that collaborated with Rotem and Locar to publish a report<\/a> on the findings. \u201cThis incident resulted in the exposure of sensitive keys and secrets, granting unauthorized access to customer data.\u201d<\/p>\n

The report noted that a \u201csophisticated and extensive\u201d infrastructure designed by French-speaking threat actors was used to conduct comprehensive scans of the internet for detecting exploitable vulnerabilities.<\/p>\n

\u201cAll services are operating as expected,\u201d an AWS spokesperson said.\u00a0\u201cAWS credentials include secrets that must be handled securely. AWS provides capabilities which remove the need to ever store these credentials in source code. For example, AWS Secrets Manager helps you manage, retrieve, and rotate database credentials, API keys, and other secrets throughout their lifecycles. Customers still sometimes inadvertently expose credentials in public code repositories. When AWS detects this exposure, we automatically apply a policy to quarantine the IAM user with the compromised credentials to drastically limit the actions available to that user, and we notify the customer. If a customer\u2019s credentials are compromised, we recommend they revoke the credentials, check AWS CloudTrail logs for unwanted activity, and review their AWS account for any unwanted usage.\u201d<\/p>\n

<\/a>A hacker goof-up gave away the operation<\/h2>\n

The S3 bucket attackers used to store the data stolen from the victims had, ironically, a misconfiguration which resulted in it being open to analysis by the researchers.<\/p>\n

\u201cThe S3 bucket was being used as a \u2018shared drive\u2019 between the attack group members, based on the source code of the tools used by them,\u201d the researchers said.<\/p>\n

The code in the S3 bucket revealed that the breach involved discovery and exploitation, starting with AWS IP ranges expanded into domain lists via Shodan and SSL certificate analysis. Scans then targeted exposed endpoints and system types, extracting data like database credentials and AWS keys.<\/p>\n

Attackers deployed custom scripts, including Python and PHP, to exploit open-source tools like Laravel to harvest credentials, including Git, SMTP, and cryptocurrency keys. Verified credentials were stored for later use, and remote shells were installed for deeper access when needed.<\/p>\n

AWS keys were tested for access to IAM, SES, SNS, and S3 services, enabling attackers to establish persistence, send phishing emails, and steal sensitive data. AI service keys were notably excluded, likely due to outdated tools or limited value.<\/p>\n

\u201cWe originally discovered the operation in August of 2024, and on September 26, we sent the report to AWS Security, since most of the victims targeted by the attack were AWS customers,\u201d the researchers said in the report. \u201cThey began to take immediate actions to mitigate the impact and alert the affected customers of the risk.\u201d<\/p>\n

Researchers highlighted that the misconfigurations enabling this attack fall under customers\u2019 responsibilities within the shared responsibility model and could happen with any Cloud Service Provider (CSP).<\/p>\n

On November 9, the AWS security team confirmed the complete handling of the issue.<\/p>\n

<\/a>Evidence points to a ShinyHunters regroup<\/h2>\n

The attack infrastructure, that Rotem and Locar stumbled upon, revealed the code used by the attackers along with the potential identities of a few people behind it.<\/p>\n

\u201cWhile the group conducts its business under a different name, \u2018Nemesis,\u2019 we were also able to connect some of the activity to the now defunct attack group \u2018Shiny Hunters,\u2019\u201d the researchers said.<\/p>\n

ShinyHunters is a notorious hacking group known for running BreachForums with Baphomet before it was decommissioned by a law enforcement<\/a> seizure in May.<\/p>\n

While no ShinyHunters activity was reported since, BreachForums was revived<\/a> shortly after, possibly under a new administration by prominent hackers like IntelBroker<\/a>.<\/p>\n

\u201cThe operators use tools which appear to be the same as those used by the \u2018ShinyHunters\u2019 hacking group,\u201d researchers said, adding that the tools are documented in French and signed by \u201cSezyo Kaizen.\u201d The alias has been linked to Sebastien Raoult, a ShinyHunters member, who was arrested and extradited to the US<\/a> and pleaded guilty in January 2024 to charges of conspiracy to commit wire fraud and aggravated identity theft.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Terabytes of data belonging to thousands of AWS customers, including customer details, AWS credentials, and proprietary source code, were compromised in a large-scale cyber operation linked to the now-defunct ShinyHunters hacking group. Independent cybersecurity researchers, Noam Rotem and Ran Locar, found the operation exploiting vulnerabilities and misconfigurations in a number of public sites to gain […]<\/p>\n","protected":false},"author":0,"featured_media":1151,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1169","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1169"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1169"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1169\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/1151"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}