Hackers are turning Amazon S3 bucket encryption against customers in new ransomware campaign – and they’ve already claimed two victims
Attackers are using AWS’ server-side encryption to conduct ransomware attacks


Hackers who were able to steal data belonging to two AWS customers used the platform’s encryption capabilities to conduct a novel type of ransomware attack, researchers have warned.
A new report from cyber resilience firm Halcyon’s RISE team identified a new ransomware campaign targeting Amazon S3 buckets, where the attackers leverage AWS’ server-side encryption along with the Customer Provided Keys (SSE-C) to encrypt victim data.
The group, referred to as ‘Codefinger’ in the report, is reported to have attacked at least two victims, but the technique represents a worrying development as it requires no exploitation of vulnerabilities in the AWS platform.
Instead, if the threat actor is able to steal a customer’s account credentials they are able to use AWS’ secure encryption infrastructure to lockdown the victim’s data, with no known method of recovery without meeting their demands.
The attacker generates and stores AES-256 encryption keys locally, and Halcyon noted that because AWS does not store the encryption key it cannot help recover the data when victims report an attack.
AWS only logs a hash-based message authentication code (HMAC) of the key in its governance service, which the report states is insufficient for recovering any encrypted data, or for forensic analysis of the attack either.
Once they have encrypted the victim’s assets, the files are marked for deletion within seven days in order to coerce the victims into paying, warning them not to try to alter their account permissions and interfere with their access.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Hardening Amazon S3 to avoid compromise
The report noted that although Amazon’s server-side encryption feature has been around for some time, this looks like the first time ransomware operators have used it for malicious purposes, stating that it identified two victims who were impacted by the attack “in recent weeks”.
Halcyon said AWS users can mitigate the threat and harden their AWS environments by restricting SSE-C usage, monitoring and auditing their keys, and implementing advanced logging.
Customers should regularly review permissions for their AWS keys, Halcyon advised adding they should also disable unused keys and rotate active keys frequently.
ITPro approached AWS for a statement on the technique and a spokesperson for the firm said it protects customers to the best of its ability when their keys are exposed, pointing to its shared responsibility model for cloud assets.
RELATED WHITEPAPER
“AWS helps customers secure their cloud resources through a shared responsibility model. Anytime AWS is aware of exposed keys, we notify the affected customers,” the spokesperson said.
“We also thoroughly investigate all reports of exposed keys and quickly take any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment.”
The spokesperson added that all customers are strongly advised to act quickly if they believe their credentials may have been compromised.
“We encourage all customers to follow security, identity, and compliance best practices. In the event a customer suspects they may have exposed their credentials, they can start by following the steps listed in this post. As always, customers can contact AWS Support with any questions or concerns about the security of their account.”
Solomon Klappholz is a former Staff Writer at ITPro adn ChannelPro. He has experience writing about the technologies that facilitate industrial manufacturing which led to him developing a particular interest in IT regulation, industrial infrastructure applications, and machine learning.
-
Security experts issue warning over the rise of 'gray bot' AI web scrapers
News While not malicious, the bots can overwhelm web applications in a way similar to bad actors
By Jane McCallion Published
-
Does speech recognition have a future in business tech?
Once a simple tool for dictation, speech recognition is being revolutionized by AI to improve customer experiences and drive inclusivity in the workforce
By Jonathan Weinberg Published
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie Published
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott Published
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott Published
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz Published
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz Published
-
The Zservers takedown is another big win for law enforcement
News LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
By Solomon Klappholz Published
-
There’s a new ransomware player on the scene: the ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry – and researchers warn it’s only going to get worse for potential victims
News Security experts have warned the BlackLock group could become the most active ransomware operator in 2025
By Solomon Klappholz Published
-
Ransomware missteps that can cost you
Whitepaper Agile risk management starts with a common language
By ITPro Published