AWS Ransom Drama: Codefinger Strikes with Stolen Keys and Encryption Hijinks
Codefinger, the cyber mischief-maker, is turning AWS keys into ransom demands by encrypting data in S3 buckets, leaving victims in a pickle. Instead of exploiting AWS vulnerabilities, they snatch credentials and use AWS’s own encryption tools to lock up data tighter than a jar of pickles.
Hot Take:
Well, it looks like hackers have finally found a way to make AWS users pay an unexpected subscription fee—except, this one doesn’t come with any new features, just a hefty dose of panic and an existential crisis about cloud security!
Key Points:
- Threat actor “Codefinger” is encrypting data in AWS S3 buckets using stolen credentials.
- The attack leverages AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C).
- Victims are left with ransom notes demanding payment for decryption keys.
- Files are marked for deletion within seven days to add pressure.
- Organizations can mitigate risks by reviewing and restricting permissions for AWS keys.
Already a member? Log in here