Defending Against Codefinger Ransomware in AWS S3 by Lucie Cardiet

This report describes the Codefinger cloud-native ransomware campaign that abuses compromised AWS API keys and S3 SSE-C to encrypt objects and mark them for deletion, preventing recovery via normal means. It breaks down the attack workflow from initial access and discovery to encryption and ransom deployment, provides preventative controls (short-term credentials, S3 versioning/object locking, restricting SSE-C, centralized key management, logging/monitoring) and detection/response best practices, and highlights how the Vectra AI platform can aid visibility, prioritization, and automated containment.