Loading threat actor…
Codefinger is a ransomware threat actor first reported in January 2025 for targeting Amazon Web Services environments, particularly Amazon S3 buckets. The actor abuses Amazon S3 server-side encryption with customer-provided keys (SSE-C) to encrypt victim-held objects using an attacker-controlled AES-256 key. Because AWS does not retain the supplied SSE-C key, victims cannot recover the affected data without the key retained by the actor. Codefinger demands payment in exchange for the decryption key. This represents a cloud-native ransomware model that abuses legitimate storage encryption functionality rather than relying on conventional endpoint-deployed file-encryption malware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted S3-focused ransomware activity by using Amazon S3 server-side encryption with customer-provided keys (SSE-C), leaving victims and AWS unable to recover the encryption key.
Conducted a ransomware campaign abusing customer-provided encryption key functionality in cloud object storage to make victim data inaccessible and extort payment for the encryption key.
AWS S3 환경에서 SSE-C 기능을 악용해 데이터를 암호화하고, 복호화용 AES-256 키 제공 대가로 금전을 요구하는 클라우드 대상 랜섬웨어로 언급됨.
Ransomware activity targeting AWS environments, specifically encrypting S3 buckets (as contrasted with Crimson Collective’s extortion/data theft approach).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.