--- title: "Amazon S3 Ransomware Defenses [Cheat Sheet] - Cybr" description: "Learn how to defend against the growing Amazon S3 ransomware threat with our cheat sheet breaking down effective prevention, detection, and recovery." url: https://cybr.com/cloud-security/amazon-s3-ransomware-defenses-cheat-sheet/ --- # Amazon S3 Ransomware Defenses \[Cheat Sheet\] Learn how to effectively defend against Amazon S3 Ransomware with our cheat sheet. Christophe Published April 23, 2025 In the [prior cheat sheet](https://cybr.com/cloud-security/amazon-s3-ransomware-attacks-cheat-sheet/), we looked at Amazon S3 Ransomware Attacks. This time, let’s take a look at effective defenses. Special thanks to [Jason Kao](https://www.linkedin.com/in/kaojason/) from [Fog Security](https://www.fogsecurity.io/) for collaborating on these cheat sheets! ## Cheat Sheet Download You can download it (and feel free to share!), and we provide a breakdown below: ## Amazon S3 Ransomware Defenses [Cybr](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/) [Fog Security](https://www.fogsecurity.io/) [Jason Kao](https://www.linkedin.com/in/kaojason/) ### Defense Techniques #### Prevention IAM restrictions: - Bucket Policies - RCPs & SCPs - IAM least privilege Data Deletion Prevention: - Object Lock - Versioning Refer to footnote \[1\] for examples and more info #### Detection Monitor and Alerting: - Monitor S3 activity via CloudTrail (including data events) - Create CloudWatch alarms - Set up Lambda functions for automated response Audit: - Monitor KMS Encryption Keys - Perform regular security audits #### Recovery Backup data: - Cross-account with AWS Backup - Isolate via IAM and separate encryption keys Simulations: - Simulate ransomware attacks - Test recovery procedures regularly ### Testing & Tools #### RansomWhen KMS-based S3 ransomware detection Tool #1 - Enumerates identities that can lock S3 buckets using KMS - Detects occurrences of S3 ransomware using KMS GitHub: [https://github.com/Permiso-io-tools/RansomWhen](https://github.com/Permiso-io-tools/RansomWhen) #### Stratus Red Team Cloud attack simulation framework Tool #2 - Launch simulated cloud attacks - Includes multiple S3 ransomware simulations Website: [https://stratus-red-team.cloud](https://stratus-red-team.cloud/) #### Finders Keepers KMS key resource finder Tool #3 - Finds resources encrypted with a specific KMS key - Helps determine the blast radius of compromised keys Website: [https://github.com/FogSecurity/finders-keypers](https://github.com/FogSecurity/finders-keypers) ``` › python3 finders_keypers.py --keyarn \ arn:aws:kms:us-east-1:123412341234:key/aaaaaaaa-aaaa-1111-aaaa-aaaa1111aaaa Total Number of Resources encrypted with KMS Key Provided: 5 example-bucket-finderskeypers vol-12341234123412345 vol-43214321432154321 arn:aws:dynamodb:us-east-1:123412341234:table/my-first-dynamodb-table arn:aws:ssm:us-east-1:123412341234:parameter/sample-parameter ``` #### YES3 Scanner S3 Security Scanner Tool #4 - Looks for potential S3 security issues related to access, encryption, and ransomware Website: [https://github.com/FogSecurity/yes3-scanner](https://github.com/FogSecurity/yes3-scanner) ``` › python3 yes3.py --profile --region YES3 SCANNER RESULTS AWS Account: 123412341234 Account Settings Account Block Public Access Overall Status: OK Bucket Summary Total Buckets: 14 Buckets potentially public: 3 fog-pub-sample-bucket | Public Method: ['acl'] fog-pub-sample | Public Method: ['policy', 'acl'] ``` ### Demo these tools with **Cybr’s 1-Click Deploy** Hands-On Labs [**Encrypting S3 Data with SSE-KMS - AWS Console** Learn how to encrypt S3 data with SSE-KMS using the AWS Console](https://cybr.com/hands-on-labs/lab/encrypting-s3-data-with-sse-kms-aws-console/)[**S3 Ransomware Through Client-Side Encryption** Test S3 ransomware through client-side encryption in a safe environment](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-client-side-encryption/)[**S3 Ransomware through batch file deletion** Test S3 ransomware through batch file deletion in a safe environment](https://cybr.com/hands-on-labs/lab/s3-ransomware-simulation-through-batch-file-deletion/)[**Securing S3 Against Ransomware with YES3** Use the YES3 scanning tool to discover S3 issues that could lead to ransomware](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/) ### Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt **Cybr** **Add’l Sources and more info:** [\[1\] FogSecurity: Complete Guide to Ransomware Protection in S3 and KMS](https://www.fogsecurity.io/blog/the-complete-guide-to-ransomware-protection-in-s3-and-kms) [List of attack simulation tools](https://cybr.com/cheat-sheets/cloud-attack-simulations/) [Ransomware in Amazon S3: SSE-C (detection tips & tricks)](https://www.fogsecurity.io/blog/ransomware-in-aws-s3-sse-c) **More AWS security cheat sheets:** [https://cybr.com/aws-cheat-sheets](https://cybr.com/tag/aws-security-cheat-sheets/) ## Defense Techniques Defending against S3 ransomware comes down to 3 main approaches: 1. Prevention 2. Detection 3. Recovery For more info on how to effectively implement all 3, check out the sources listed at the end of this post. ### Prevention For prevention, we’re primarily looking at implementing the following. IAM restrictions: - Bucket Policies - RCPs & SCPs - IAM least privilege
 Data Deletion Prevention: - Object Lock - Versioning ### Detection Detection mainly comes down to the following. Monitoring and alerting: - Monitor S3 activity via CloudTrail (including data events) - Create CloudWatch alarms - Set up Lambda functions for automated response Audit: - Monitor KMS encryption keys - Perform regular security audits ### Recovery To help with recovery, we need to make sure the following are in place. Backup data: - Cross-account with AWS Backup - Isolate via IAM and separate encryption keys Simulations: - Simulate ransomware attacks - Test recovery procedures regularly ## Testing and Tools To help you test the effectiveness of your prevention, detection, and recovery efforts, here are 4 open source tools you can deploy: - RansomWhen - Stratus Red Team - Finders Keepers - YES3 Scanner ### RansomWhen KMS-based S3 ransomware detection - Enumerates identities that can lock S3 buckets using KMS - Detects occurrences of S3 ransomware using KMS - GitHub: [https://github.com/Permiso-io-tools/RansomWhen](https://github.com/Permiso-io-tools/RansomWhen) ### Stratus Red Team Cloud attack simulation framework - Launch simulated cloud attacks - Includes multiple S3 ransomware simulations - Website: [https://stratus-red-team.cloud](https://stratus-red-team.cloud/) [Deploy this tool for free with our Hands-On Lab >](https://cybr.com/hands-on-labs/lab/backdoor-an-s3-bucket-via-its-bucket-policy/) ### Finders Keepers KMS key resource finder - Finds resources encrypted with specific KMS key - Helps determine blast radius of compromised keys - Website: [https://github.com/FogSecurity/finders-keypers](https://github.com/FogSecurity/finders-keypers) ### YES3 Scanner S3 Security Scanner - Looks for potential S3 security issues related to access, encryption, and ransomware - Website: [https://github.com/FogSecurity/yes3-scanner](https://github.com/FogSecurity/yes3-scanner) [Deploy this tool for free with our Hands-On Lab >](https://cybr.com/hands-on-labs/lab/securing-s3-against-ransomware-with-yes3/) ## Sources and more info - [Complete Guide to Ransomware Protection in S3 and KMS](https://fogsecurity.io/blog/the-complete-guide-to-ransomware-protection-in-s3-and-kms) - [Cloud attack simulation cheat sheet](https://cybr.com/cheat-sheets/cloud-attack-simulations/) - [Ransomware in Amazon S3: SSE-C (detection tips & tricks)](https://fogsecurity.io/blog/ransomware-in-aws-s3-sse-c) ### [More AWS Security cheat sheets](https://cybr.com/tag/aws-security-cheat-sheets/) ## Filed under - [Blue Team](https://cybr.com/blue-team/) - [Cloud Security](https://cybr.com/cloud-security/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/) - [Cheat Sheets](https://cybr.com/tag/cheat-sheets/) - [Cloud Security](https://cybr.com/tag/cloud-security/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)