AWS RANSOMWARE ANALYSIS

Summary from the TLDR InfoSec newsletter

This post discusses a recent customer engagement that entailed responding to an AWS ransomware attack. The attacker deleted several S3 buckets and then left a ransom note (included in the post) and a recovery binary. The post goes through the CloudTrail actions taken by the attackers as well as an analysis of the recovery binary. It concludes by noting that the binary does not make any connections to AWS (or the internet in general) and would not be able to recover the data.