SSE-C Encryption Hijacking
A cloud-native ransomware attack vector where threat actors use compromised IAM credentials to execute CopyObject API calls with Server-Side Encryption using Customer-Provided Keys (SSE-C), re-encrypting an organization's S3 data with an attacker-controlled key and permanently locking the owner out.
Summary
A cloud-native ransomware attack vector where threat actors use compromised IAM credentials to execute CopyObject API calls with Server-Side Encryption using Customer-Provided Keys (SSE-C), re-encrypting an organization's S3 data with an attacker-controlled key and permanently locking the owner out.
Represents the evolution of cloud ransomware from data exfiltration and deletion to weaponizing legitimate AWS encryption APIs. Unlike traditional ransomware that is noisy and detectable, SSE-C hijacking uses standard S3 operations that pass all API validation. The only durable defense is S3 Object Lock in Compliance Mode, which prevents any modification — including re-encryption — during the retention period.
- Default encryption at rest does NOT protect against this attack — SSE-C hijacking uses valid API calls with valid credentials to re-encrypt data.
- Versioning alone is insufficient — attackers can delete version markers or re-encrypt all versions.
- MFA Delete adds friction for automated scripts but does not prevent legitimate CopyObject API calls with SSE-C headers.
constrained_byObject Lock / WORM Semantics — the only cryptographic guarantee against re-encryption during retention periodsconstrained_byEncryption / KMS — proper KMS key policies can restrict who performs encryption operationsscoped_toS3 — exploits native S3 API operations that pass all standard validation
Definition
A cloud-native ransomware attack vector where threat actors use compromised IAM credentials to execute CopyObject API calls with Server-Side Encryption using Customer-Provided Keys (SSE-C), re-encrypting an organization's S3 data with an attacker-controlled key and permanently locking the owner out.
Connections 3
Outbound 3
scoped_to1constrained_by2Resources 3
Detailed guide on using S3 Object Lock to defend against cloud-native ransomware including SSE-C re-encryption attacks.
Analysis of S3 Object Lock as defense against encryption hijacking, covering Compliance vs Governance mode trade-offs.
MinIO's implementation of immutable WORM storage as ransomware defense for on-premises S3-compatible deployments.