# Massive AWS Extortion Campaign Hits 110K Domains! 💥

**URL:** <https://onehack.st/t/massive-aws-extortion-campaign-hits-110k-domains/289569>\
**Category:** News & Articles\
**Tags:** hacking, data-recovery\
**Created:** [August 22, 2024, 3:11am UTC](https://onehack.st/t/massive-aws-extortion-campaign-hits-110k-domains/289569 "2024-08-22T03:11:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [August 22, 2024, 3:11am UTC](https://onehack.st/t/massive-aws-extortion-campaign-hits-110k-domains/289569/1 "2024-08-22T03:11:46Z")

</div>

**Summary:**

1. **Extortion Attack**  
A sophisticated extortion scheme has targeted 110,000 domains by exploiting misconfigured AWS .env files. Attackers replaced S3-stored data with ransom notes.

2. **Exploited Vulnerabilities**  
The campaign involved scanning for exposed cloud access keys, using API calls to enumerate IAM users, and escalate permissions via newly created IAM roles.

3. **Automated Scanning**  
Attackers employed AWS Lambda functions for automated scanning, highlighting advanced tactics in their operation.

**Read more at:** [The Register](https://theregister.com)