Ransomeware Exploits AWS Encryption to Lock S3 Buckets

AWS S3 feature exploited by ransomware hackers to encrypt storage buckets

AWS server-side encryption is being abused in the next evolution of ransomware

Ransomware crew abuses AWS native encryption

'Codefinger' crims on the hunt for compromised keys

Ransomware abuses Amazon AWS feature to encrypt S3 buckets

A new ransomware campaign encrypts Amazon S3 buckets using AWS's Server-Side Encryption with Customer Provided Keys (SSE-C) known only to the threat actor, demanding ransoms to receive the decryption key. [...]

New Amazon Ransomware Attack—‘Recovery Impossible’ Without Payment

Threat researchers have identified a new “recovery impossible” ransomware campaign targeting Amazon Web Services. Here’s what you need to know.

New Codefinger Ransomware Exploits AWS to Encrypt S3 Buckets

Codefinger ransomware is targeting Amazon S3 buckets leveraging AWS's Server-Side Encryption with Customer-Provided Keys to encrypt data.

Ransomware Crew Abuses AWS Native Encryption, Sets Data-Destruct Timer for 7 Days

A new ransomware group called Codefinger targets AWS S3 buckets by exploiting compromised or publicly exposed AWS keys to encrypt victims' data using AWS's own SSE-C encryption, rendering it inaccessible without the attacker-generated AES-256 keys. While other security researchers have documented techniques for encrypting S3 buckets, "this is the first instance we know of leveraging AWS's native secure encryption infrastructure via SSE-C in the …