ctrlINT What the industry said about every indicator, with the quote

CodefingerThreat actor

Codefinger is a ransomware group that targets Amazon S3 buckets by exploiting AWS’s Server-Side Encryption with Customer Provided Keys to encrypt victim data. They utilize compromised AWS credentials to gain access and demand Bitcoin ransoms for the decryption keys, threatening to delete files if negotiations fail.From MISP Galaxy

Last reported 4 months ago, by Datadog Security Labs2 reports

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1485Data Destruction

    “…hreat actor Bling Libra used stolen AWS credentials to access and delete data from S3 buckets, then extorted victims by threatening data destruction or leaks.”

    Trend Micro ResearchVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “In January 2025, Halcyon reported that a threat actor named Codefinger was conducting a ransomware campaign by abusing the server-side encryption with customer-provided keys (SSE-C) of AWS S3.”

    Datadog Security LabsVendor
    Holding blobs for ransom: Four methods for Azure Storage ransomware

  2. “Early this year, security researchers published a blog entry detailing how a threat actor called Codefinger leveraged SSE-C to carry out ransomware activity on S3 buckets.”

    Trend Micro ResearchVendor
    Breaking Down S3 Ransomware: Variants, Attack Paths and Trend Vision One™ Defenses

Indicators in its reports

named in the reports above
Copy these 10 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Codefinger here?
No account needed. We do not store your IP address.