The landscape of cloud ransomware is rapidly transforming, with cybercriminals shifting their strategies from exploiting cloud service provider (CSP) vulnerabilities to targeting web applications, particularly those built with PHP.

The Changing Tactics of Ransomware Operators

Cloud service providers have significantly improved their data protection mechanisms, forcing ransomware groups to develop more sophisticated attack methods. In response, attackers are now focusing on web applications, which are often hosted on cloud services and can be more vulnerable to exploitation.

Emerging Ransomware Scripts

Researchers from SentinelOne have uncovered new ransomware scripts specifically designed to attack PHP applications. Three notable examples include:

1. Pandora Script: A Python-based ransomware that:

   • Uses AES encryption
   • Targets PHP servers, Android, and Linux systems
   • Encrypts files using the OpenSSL library
   • Writes PHP code to a specific path

2. IndoSec Group's Approach: An innovative PHP backdoor that:

   • Manages and deletes files
   • Searches through directories
   • Encodes file contents using a web service's API

3. ShadowWeave Script: A newly discovered ransomware targeting cloud-based microservices that:

   • Exploits container misconfigurations
   • Uses distributed network infiltration techniques
   • Implements polymorphic encryption algorithms
   • Leaves minimal forensic traces by leveraging serverless computing environments

Innovative Data Exfiltration Techniques

Cybercriminals are also leveraging legitimate cloud-native functions to steal data. Recent attacks have shown threat actors using:

• Azure Storage Explorer
• Amazon S3 storage
• FTP sites

The RansomES Script: An Emerging Threat

Researchers identified a Python script called RansomES, which:

• Infiltrates Windows systems
• Targets specific file types (.doc, .xls, .jpg, .png, .txt)
• Exfiltrates files to S3 storage or FTP sites
• Encrypts local file versions

Protecting Against These Emerging Threats

To mitigate risks, organizations should:

• Implement robust service control policies
• Regularly update and patch web applications
• Monitor for unusual file access and encryption activities
• Use multi-layered security approaches
• Conduct frequent vulnerability assessments of cloud-based applications
• Implement strict container security protocols

As cloud technologies continue to evolve, so do the tactics of ransomware operators. The emergence of scripts like ShadowWeave demonstrates the increasing sophistication of cloud-based cyber threats. Staying informed and proactive is crucial in maintaining robust cybersecurity defenses.