Ransomware crew abuses AWS native encryption, sets data-destruct timer for 7 days

A newly observed ransomware crew called Codefinger has been encrypting AWS S3 data by abusing exposed or compromised IAM keys to apply AWS SSE-C (customer-provided keys) with attacker-generated AES-256 keys, then marking objects for deletion via S3 lifecycle policies and leaving ransom notes; this leverages AWS's native encryption mechanisms to prevent victims from decrypting data and represents a potentially serious systemic risk if the technique becomes widespread.