Abuse of AWS KMS DeleteImportedKeyMaterial for Data Sabotage

Adversaries are targeting AWS Key Management Service (KMS) environments by invoking the 'DeleteImportedKeyMaterial' API action on customer-managed keys that rely on imported key material (Bring Your Own Key - BYOK). Unlike the standard 'ScheduleKeyDeletion' process, which enforces a mandatory waiting period of 7 to 30 days, 'DeleteImportedKeyMaterial' executes instantly. This action transitions the target key to a 'PendingImport' state, effectively ceasing all cryptographic operations. Data encrypted under these keys becomes immediately inaccessible. If the original key material is not retained by the customer, this action results in permanent data loss. This technique is observed in the context of cloud-based ransomware and sabotage operations, where attackers aim to destroy data or hold it for ransom by controlling the availability of the decryption material. Defenders must treat this action as a high-risk destructive primitive, particularly when triggered by non-service principals.

Attack Chain

1. Attacker gains persistence or elevates privileges within the AWS cloud environment.
2. Attacker enumerates existing KMS keys to identify those with an external origin (BYOK).
3. Attacker evaluates the target key's permissions to ensure they possess 'kms:DeleteImportedKeyMaterial' capabilities.
4. Attacker identifies critical encrypted assets (S3 buckets, EBS volumes, or RDS databases) protected by the targeted KMS keys.
5. Attacker executes the 'DeleteImportedKeyMaterial' API call against the chosen KMS keys.
6. The target key enters 'PendingImport' state, causing immediate decryption failures across dependent cloud services.
7. Attacker demands ransom or destroys the original key material to ensure the data remains permanently unrecoverable.

Impact

Successful exploitation results in the immediate, widespread outage of services relying on the affected KMS keys. Depending on the data stored (e.g., S3 buckets, RDS snapshots, Secrets Manager), this leads to critical business disruption. If the adversary destroys the externally hosted key material, the data becomes unrecoverable, causing irreversible financial and operational damage.

Recommendation

1. Deploy the suggested detection rule for 'DeleteImportedKeyMaterial' using AWS CloudTrail logs.
2. Configure AWS Organizations SCPs to strictly limit the principals authorized to perform 'kms:DeleteImportedKeyMaterial' and 'kms:ImportKeyMaterial'.
3. Monitor for unauthorized use of these KMS APIs, focusing on non-service principals and unexpected network sources.
4. Implement robust backup and secure storage procedures for all external key material (BYOK) used within the environment.
5. Perform an audit of KMS key policies to ensure the principle of least privilege is applied to destructive administrative actions.