Elastic Block Store - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/elastic-block-store/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 19:31:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAWS EC2 EBS Snapshot Exfiltration via ModifySnapshotAttributehttps://feed.craftedsignal.io/briefs/2026-09-aws-ebs-snapshot-sharing/Fri, 18 Sep 2026 19:31:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-aws-ebs-snapshot-sharing/Adversaries may exploit the ModifySnapshotAttribute API to share Amazon EBS snapshots with external accounts or the public, facilitating data exfiltration and unauthorized access to sensitive volume data.Attackers target Amazon Web Services (AWS) environments by exploiting the ModifySnapshotAttribute API to change the permissions of Amazon Elastic Block Store (EBS) snapshots. By adding external AWS account IDs or setting the snapshot attribute to group=all (making the volume public), adversaries can copy and mount sensitive data volumes within their own attacker-controlled AWS environments. This technique is often a precursor to broader data exfiltration or persistence operations, as it allows attackers to bypass account-level isolation and staging of stolen data. Since snapshots often contain critical system data or database backups, unauthorized access represents a significant risk to organizational confidentiality and regulatory compliance. Defenders should monitor CloudTrail logs for successful modifications to snapshot permissions that do not align with authorized internal replication workflows or backup automation.

Impact

Successful exploitation allows for the unauthorized extraction of data stored within EBS volumes, which may include database contents, configuration files, and sensitive application data. Once a snapshot is shared, the data can be fully replicated to an adversary's account, resulting in a complete breach of confidentiality. Publicly exposed snapshots (group=all) are susceptible to automated discovery by third parties, exponentially increasing the risk of data compromise.

Recommendation

  • Implement monitoring for ModifySnapshotAttribute API calls in CloudTrail to identify when EBS snapshots are shared with non-authorized AWS accounts or made public.
  • Apply Service Control Policies (SCPs) organization-wide to explicitly prohibit the public sharing of EBS snapshots.
  • Use AWS Config rules like ebs-snapshot-public-restorable-check to automatically detect and remediate publicly accessible snapshots.
  • Restrict the ec2:ModifySnapshotAttribute IAM permission to only a limited set of administrative roles and enforce the use of Multi-Factor Authentication (MFA).
  • Conduct regular audits of EBS snapshot permissions to identify and remove unauthorized access entries.
]]>mediumadvisorycloudexfiltrationawsmonitoring