Extortion Campaign Exploiting Exposed Environment Variable (Campaign)

Researchers uncovered a large-scale extortion campaign that scanned for exposed `.env` files to harvest sensitive credentials, gained access to misconfigured AWS environments (using API calls such as `GetCallerIdentity` and `ListUsers`), escalated privileges by creating admin IAM roles, deployed AWS Lambda functions to automate scanning and S3 data exfiltration, and left ransom notes in compromised storage — targeting over 230 million domains and harvesting ~90,000 environment variables (7,000 linked to cloud services).