{
  "name": "Fake LockBit Real Damage Ransomware Samples Abuse AWS S3 to Steal Data",
  "slug": "fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-steal-data",
  "description": "This report discusses malicious Golang ransomware samples that exploit Amazon S3's Transfer Acceleration feature to exfiltrate victims' data and upload it to attacker-controlled S3 buckets. The samples contained hard-coded AWS credentials linked to compromised accounts, allowing the researchers to track and report malicious activity. The ransomware attempted to disguise itself as LockBit ransomware, likely to leverage its notoriety and pressurize victims, though no connection to LockBit's operators was found.",
  "published": "2024-10-17T07:43:06+00:00",
  "created_at": "2024-10-17T07:43:06+00:00",
  "modified_at": "2024-10-17T08:20:43+00:00",
  "created_at_opencti": "2024-10-17T07:43:06+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-17",
    "aws",
    "data exfiltration",
    "golang",
    "lockbit-imitation",
    "ransomware"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "f0ab7baa3e734451716ab374109453c1c159533023966d9db384f91da7c16f7f"
      },
      {
        "id": "",
        "name": "f09f05fdd4dbe9a7b321f0aa4d56ae662e41a63385fd1a1e7f446d4af19a10d4"
      },
      {
        "id": "",
        "name": "e4c59a0b4d209e898572e4fdd6153e6510e92fc16384b71a11f2b68210dd8174"
      },
      {
        "id": "",
        "name": "e02b3309c0b6a774a4d940369633e395b4c374dc3e6aaa64410cc33b0dcd67ac"
      },
      {
        "id": "",
        "name": "dbcfa51d8924096c9df053f9f8e8bfcb9f512d6067e8310e8a4743c55f016593"
      },
      {
        "id": "",
        "name": "d7b9db3f4ed6992d352248122cbc286a32a3555648b33115f6fe8672aa7bc8fe"
      },
      {
        "id": "",
        "name": "cded5f02f06bc64e3aa909f021a35b00740832f5eaf9ffec8ca7be73e74c1152"
      },
      {
        "id": "",
        "name": "cdb2a7767779e0d0efaecfdc1fce41bf51d3677194205d486e8c5a0c4815ee65"
      },
      {
        "id": "",
        "name": "c55fe2e800701ca55a3ec1bac9a42931e30dc3a01bbb431508e7ba21e672e64e"
      },
      {
        "id": "",
        "name": "bc73cc463ea4f6c0e8d65e28c5a72c474e73176a2dabb18776cb471eb209457e"
      },
      {
        "id": "",
        "name": "b32f634f34465b056090fe136ddad42365748e84eed4dd37ce5d145f0377794e"
      },
      {
        "id": "",
        "name": "aca17ec46730f5677d0d0a995b65504e97dce65da699fac1765db1933c97c7ec"
      },
      {
        "id": "",
        "name": "a28af0684456c26da769a2e0d29c5a726e86388901370ddf15bd3b355597d564"
      },
      {
        "id": "",
        "name": "9fd4ffc73d7de7fa881fd4de477f74c49b73e2aa117e7f3fb800ef5bf6cf73b8"
      },
      {
        "id": "",
        "name": "9e792606d9060f0988c9615aa785685f8474b50e00ce58c559821066b842b515"
      },
      {
        "id": "",
        "name": "967375af79a5745a9bc97e0d6513d30b797fe834b0f700f48512e3c89cf35328"
      },
      {
        "id": "",
        "name": "90c429ebe6c41470f921debcb1b8c3a536b213f7c56d4adccb19a01e471fba04"
      },
      {
        "id": "",
        "name": "8e404487edabbc46d92f8c63b90ac9f661698a5a96691e255ff576e246bca86c"
      },
      {
        "id": "",
        "name": "88237de0db05a0bc5b9de9eb77a4e43595de6b8652affc51b9d20ad22012c136"
      },
      {
        "id": "",
        "name": "7dbb35453d362309618159b5a796e86a95299dd259be033671705663f378691d"
      },
      {
        "id": "",
        "name": "7bfa19a76ae96c1eb630f56c2d4e38f9df62c04cae29755aebf08f71832b7b84"
      },
      {
        "id": "",
        "name": "7a018c849aa2cadf29c498771b9dfcf478029b61a11b6241cda0ebafff6d8f30"
      },
      {
        "id": "",
        "name": "744aaf3751291085848beb170cafacc45dfab7daa725037917307b54cc1337cd"
      },
      {
        "id": "",
        "name": "573400d5f8a9d85d7205c1f6cf68f395bbb780aa81cd680dcec7b1904025f4d5"
      },
      {
        "id": "",
        "name": "3c45b5be997e9250d44ea3d3cfa85a2e341f9b5017eac694ee1d569134fdd4da"
      },
      {
        "id": "",
        "name": "39d144c97b53eb4ea0b6b76af9e2b5062730c8d134f38e017bd474e5e7af0ab1"
      },
      {
        "id": "",
        "name": "390edcbca4679129932fdeabc71b3181e1ae545d655abc06460ee838d9a11ac9"
      },
      {
        "id": "",
        "name": "371b772a5c3ac6407d77e6fc3fabb6dbb72ebddfb2ceae77147dfeee63168390"
      },
      {
        "id": "",
        "name": "35299f1f6bb224e9260a10f72087ba2193316e73eea7b0361ea9ae9b946a5fac"
      },
      {
        "id": "",
        "name": "2e62c9850f331799f1e4893698295d0b069ab04529a6db1bfc4f193fe6aded2c"
      },
      {
        "id": "",
        "name": "1a56110c5a9b11380fe8cf145ec051ac5728eb0776b0448ff8b5e6ba8d44a4e1"
      },
      {
        "id": "",
        "name": "1827bc29f0d1d1a9de9978a7852fd05a415e83d120feda6856bfd987ed2e6622"
      },
      {
        "id": "",
        "name": "17b7e5ac105cfafca07691b97689c97a9c4e2b0e11e22cb1c70d85d0cd37678c"
      },
      {
        "id": "",
        "name": "1350b1dce81952d9cca595eab8c77ea29ba46f7aa4df28f066110b14895a630c"
      },
      {
        "id": "",
        "name": "0ce98929d8a49d43476263be704aaff40b02968ca423bc4f0da89e738e9da9da"
      },
      {
        "id": "",
        "name": "06fbf383637bd94226b8257dfbd88576a1a9dca1dac8b900a20d96f39cd1475f"
      },
      {
        "id": "",
        "name": "023aff64a9ecdc012621966e1c1e5bd5957c0afcd8394bc9b2be4d77adc934db"
      },
      {
        "id": "",
        "name": "14fe0071e76b23673569115042a961136ef057848ad44cf35d9f2ca86bd90d31"
      },
      {
        "id": "",
        "name": "0c54e79e8317e73714f6e88df01bda2c569ec84893a7a33bb6e8e4cf96980430"
      }
    ],
    "attack_patterns": [
      {
        "id": "9c80a8a8-8832-4ab1-9611-41f8acd20393",
        "name": "T1565"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "3eb6d0bc-8d5f-4192-a97e-0a7bbbb5d0a3",
        "name": "T1491"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "41ad5d62-aa6a-47d6-a9a9-fb2209601099",
        "name": "T1098"
      },
      {
        "id": "306ee8dc-1d64-4916-96be-18060d690ad7",
        "name": "T1499"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/en_us/research/24/j/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-stea.html",
    "https://otx.alienvault.com/pulse/6710dc2aaaa688eb015e4a1c"
  ]
}