AWS re:Invent 2025 - Anatomy of a Cloud Ransomware Attack: A Live Simulation (HMC206)

AWS Events

36 views • Save 51 min (3 min read) • 7 months ago

Video Summary

This video simulates a cloud ransomware attack on a fictional retail company, Horizon Retail, highlighting the cascading failures that can occur. The attack begins subtly, with subtle performance issues that escalate into mass encryption and operational paralysis. The simulation underscores how human error, unpatched systems, and misconfigured cloud security settings can create entry points for attackers, leading to the compromise of critical data and business functions. A key revelation is that versioning alone is insufficient for cyber recovery, and a significant finding was the existence of untracked "shadow data" containing sensitive PII, escalating the incident into a major data breach with severe regulatory and legal ramifications.

The simulation demonstrates that effective cyber resilience requires more than just prevention; it demands a robust recovery strategy. Horizon Retail's attempts to recover from backups were hampered by the attackers' ability to compromise those backups during their extended dwell time. Ultimately, the company faced a dire choice: pay a $6 million ransom to potentially mitigate data leakage and financial losses or attempt a lengthy and uncertain rebuild. The presenter emphasizes that the decision to pay was a consequence of prior management choices to de-prioritize security investments for feature development, leading to a critical lack of cyber resilience.

Short Highlights

The simulated attack on Horizon Retail began with subtle "discordant data points" impacting EBS latency and S3 API calls, quickly escalating to mass encryption.
Attackers gained initial access through social engineering to obtain credentials for a standard employee account, then exploited an unpatched QA server and a misconfigured IAM role to compromise a cloud admin account and take over the identity provider.
Recovery attempts were thwarted because attackers had compromised backups by encrypting all versions of objects with their own keys and had poisoned restore points during a month-long dwell time.
A significant data breach occurred involving over 1 million customer records with PII (full names, email, addresses, birth dates) from untracked S3 buckets used for a development program.
The final decision to pay a $6 million ransom was driven by the immense financial losses and the need to mitigate legal liability from the data breach, highlighting a failure in prior security investment and planning.

Key Details

Scene One: The Attack Unfolds [00:00]

The simulation, named "Zero Hour," is an immersive tabletop experience designed to illustrate real cloud ransomware attack tactics, techniques, and procedures (TTPs).
Horizon Retail, a fictitious cloud-forward retail organization with AWS deployments, serves as the scenario.
The attack begins not with a single alert, but a "chorus of discordant data points" affecting EBS latency and S3 buckets, leading to mass encryption of data.
CloudTrail reveals thousands of unauthorized S3 encryption calls originating from within the VPC, targeting core buckets and encrypting data in place.
The incident escalates rapidly, impacting customer-facing websites with 503 errors and triggering alerts from GuardDuty for unusual activity from a QA server.

"This is not a runaway script. This is hostile. This is an active attack."

Scene One: Key Takeaways [11:12]

Modern attacks often start subtly, with a series of seemingly minor issues that coalesce into a significant threat.
Cloud attacks are complex, involving multiple services and requiring specialized knowledge to troubleshoot, demanding visibility into interdependencies.
Attacks on core cloud data services can paralyze entire business operations, emphasizing the need for organizations to map dependencies between critical business functions.