Ransomware abuses Amazon AWS feature to encrypt S3 buckets

A new ransomware campaign called "Codefinger" has been reported to use compromised AWS credentials to encrypt Amazon S3 objects via SSE-C (customer-provided AES-256 keys), then set object lifecycle deletion and drop ransom notes demanding Bitcoin payments; because AWS does not store SSE-C keys, victims cannot recover encrypted data without the attackers' key. Halcyon reported at least two victims and recommends preventing SSE-C usage, rotating and minimizing AWS keys and permissions, while AWS reiterates best practices for credential management and notification procedures.