Cloud Ransomware Flexes Fresh Scripts Against Web Apps

Cloud service providers are getting better at protecting data, pushing adversaries to develop new cloud ransomware scripts to target PHP applications, a new report says.

Instead of solely leaning on leaky buckets and cloud service provider (CSP) vulnerabilities to exfiltrate sensitive data, a fresh crop of cloud-targeting ransomware is aimed instead at exploiting unprotected Web applications to drop encryptors and lock up victims data.
The pivot to focusing on PHP applications demonstrates the success that CSPs have had in shoring up their environments with policies like AWSs Key Management Service, according to a new report from SentinelOne on the state of cloud ransomware landscape in 2024. CSPs can now ensure that almost no data is really lost, thanks to policies that require a waiting period and confirmation before data can be deleted. There are some fairly exotic malicious workarounds for some of these protections, but attacks can easily be blocked by implementing service control policies,
the report said
.
Cloud ransomware
operators have started to mine Web applications for opportunities in increasing volumes, according to SentinelOne.
Web applications are often run via cloud services, SentinelOnes report explained. Their more minimal nature makes cloud environments a natural hosting point where the applications are easier to manage and require less configuration and upkeep than running on a full operating system. However, Web applications themselves are vulnerable to extortion attacks.
Analysis uncovered new ransomware scripts specifically developed to attack PHP applications — such as a Python script named Pandora, and another attributed to Indonesian-based threat actor IndoSec group.
The Pandora script uses AES encryption to target several types of systems, including PHP servers, Android, and Linux, the report added. The PHP ransom functions encrypt files using AES via the OpenSSL library. The Pandora Python script runs on the Web server, writing the PHP code output to the path pandora/Ransomware with a file name provided as an argument at runtime and appended with the php extension.
The ransom script targeting PHP applications developed by IndoSec uses a PHP backdoor to manage and delete files, according to the report. It searches through directories, reads, and then encodes the file contents using a Web services API.
This is an interesting approach because the encryption is provided through a remote service, rather than using native functionality like many other tools, the report noted.
Aside from trying to breach them, adversaries have also figured out how to use these cloud services themselves to exfiltrate stolen data, the report explained. SentinelOne offers the example of September
Rhysdia
and
BianLian
cloud ransomware attacks that abandoned their historical exfiltration tools like MEGAsync and rclone, and instead used Azure Storage Explorer to download the data. The following month, the
LockBit ransomware group
was discovered using Amazons S3 storage to exfiltrate data from Windows and macOS systems, SentinelOne added.
In keeping with the trend, the SentinelOne research identified a new Python script on VirusTotal it named RansomES. This code is designed to infiltrate a Windows system, look for files with extensions that indicate the file contains data, including .doc, .xls, .jpg, .png, or .txt. Once those files have been identified, the RansomES code allows the ransomware attacker to exfiltrate those files to an S3 storage bucket or an FTP site, and encrypt the local versions.
RansomES is a simple script, and we do not believe it has been used in the wild, the report noted. The author included an Internet connectivity check to the
WannaCry killswitch domain
, which may suggest the script was developed by a researcher or someone with an interest in threat intelligence.
The key to protecting data against Web application
cloud ransomware attacks
is to assess the overall cloud environment to protect against misconfigurations and overly permissive storage buckets, the report concluded.
Additionally, always enforce good identity management practices such as requiring MFA on all admin accounts, and deploy runtime protection against all cloud workloads and resources, according to SentinelOne.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cloud Ransomware Flexes Fresh Scripts Against Web Apps