Codefinger Ransomware Campaign Targeting S3 Buckets (Campaign)

Researchers identified a ransomware campaign named Codefinger that abuses AWS Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data in S3 buckets using compromised AWS credentials. Attackers generate and retain AES-256 keys locally (AWS only keeps an HMAC), place ransom notes in affected directories, and set S3 lifecycle policies to delete files within seven days to coerce payment — the technique abuses legitimate AWS features rather than exploiting a vulnerability.