Cloud Ransomware Flexes Fresh Scripts Against Web Apps

SentinelOne's analysis shows a shift in cloud ransomware toward exploiting unprotected web applications—especially PHP apps—to drop encryptors (examples include the Pandora Python script and an IndoSec PHP-based encryptor) and a trend of using legitimate cloud-native services (S3, Azure Storage Explorer) for data exfiltration; the report highlights discovered scripts (including RansomES) and recommends enforcing service control policies, strong identity management (MFA), and runtime protection for cloud workloads.