Codefinger: When AWS Encrypts Your Data on Behalf of Hackers
In January 2025, security researchers at Halcyon documented a disturbing new ransomware campaign known as Codefinger. What makes it particularly dangerous is that it does not exploit an Amazon Web Services zero-day vulnerability. Instead, it turns AWS's own security mechanisms against its customers.
The SSE-C Attack Mechanism: It all begins with compromised AWS API keys, often stolen through GitHub leaks, phishing campaigns, or purchases on underground marketplaces. Once they have obtained credentials with s3:GetObject and s3:PutObject permissions, attackers can deploy a particularly effective technique.
Rather than downloading files, encrypting them locally, and uploading them again, which generates substantial network traffic and can trigger traditional detection tools, attackers use the legitimate AWS API to carry out the operation through server-side encryption with customer-provided keys (SSE-C). The Codefinger group generates its own AES-256 key and instructs AWS S3 to encrypt the victim's objects using this malicious encryption key.
From that point onward, AWS itself no longer retains the key and requires it for any future read operation. Without paying the attackers' ransom, the data is mathematically unrecoverable.
The Artificial Deadline Created by Lifecycle Rules: To put even more pressure on the victim, the attackers exploit another legitimate feature: S3 Object Lifecycle Management. They inject a lifecycle rule instructing AWS to permanently delete all affected files within seven days. The victim is left facing a countdown that continues relentlessly, enforced directly by the cloud provider.
Detect S3 API hijacking in real time with tamper
Protect your cloud infrastructure against ransomware and illicit encryption changes, completely agentless and with zero latency.
Abandoned Buckets (Bucketsquatting): A Hidden Supply Chain Threat
The second major threat does not target the data you currently hold. Instead, it exploits the traces your infrastructure leaves behind. Documented in detail by watchTowr Labs and more recently discussed in other public cloud environments, including Azure in research by Eye Security, abandoned bucket attacks demonstrate the risks created by cloud technical debt.
What Is Bucketsquatting? Imagine a company creates an S3 bucket named images-corp-app and associates a custom domain, assets.my-company.com, with it through a DNS CNAME record pointing to an Amazon S3 domain. A few months later, the project is discontinued.
The cloud administrator deletes the S3 bucket to reduce FinOps costs but forgets to remove the DNS CNAME record. The name images-corp-app then becomes globally available to any AWS account. An attacker scans the internet, discovers the misconfiguration, and creates an S3 bucket with exactly the same name under their own malicious AWS account.
A Major Attack Vector: The consequences can be severe. The attacker now controls the content served from assets.my-company.com. If this domain hosts a third-party JavaScript library, such as script.js, used by thousands of customer websites, the attacker can inject malicious code to conduct Magecart-style attacks, steal payment card details, or mine cryptocurrency.
This is a highly stealthy supply chain attack because the malicious traffic originates from a trusted subdomain.
How Can You Defend Against These Attacks?
These two examples show why traditional security tools, such as antivirus software and network firewalls, can be blind to cloud-native threats that simply misuse legitimate S3 APIs. Defending against them requires strict governance through Data Security Posture Management (DSPM) and continuous integrity monitoring through File Integrity Monitoring (FIM).
Here are the critical measures to implement:
Enable Versioning and Object Lock: To counter attacks such as Codefinger, Object Lock in Compliance mode prevents even an attacker with administrative credentials from altering, encrypting, or deleting protected object versions during the specified retention period.
Real-Time Behavioral Monitoring: Detect anomalies in API activity, including unusual increases in SSE-C encryption requests, rapid and repeated metadata changes, or large-scale deletion operations.
Infrastructure Auditing and DNS Cleanup: Continuously map dependencies between DNS zones, including Route 53 and Cloudflare, and the underlying storage resources. This helps identify and eliminate bucketsquatting risks.
Conclusion
The cloud attack surface requires a fundamental shift in mindset. Cybersecurity teams must integrate automated remediation processes and use monitoring tools specifically designed for S3 storage. Never underestimate the danger of a leaked API key or an orphaned DNS record. In the public cloud, today's configuration mistakes can become tomorrow's attack vectors.