AWS S3 Encryption With External Keys

Tim Peck@timpeck

•updated Nov 18, 2025•15•1•200

Detects S3 object encryption using either customer-provided keys (SSE-C) or externally managed KMS keys (BYOK/XKS). These methods are leveraged by S3 ransomware variants to encrypt data with keys that are not controlled by the victim or AWS, making recovery difficult or impossible without paying a ransom.