Codefinger is a threat actor. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Codefinger exploit?

Specific CVE exploitation data for Codefinger is being tracked. Check the Strobes VI threat actor profile for updates.

Codefinger

Exploited CVEs

Overview

Codefinger is a ransomware group that targets Amazon S3 buckets by exploiting AWS’s Server-Side Encryption with Customer Provided Keys to encrypt victim data. They utilize compromised AWS credentials to gain access and demand Bitcoin ransoms for the decryption keys, threatening to delete files if negotiations fail. The group has been observed abusing publicly disclosed AWS keys with permissions to read and write S3 objects, making recovery impossible without their cooperation. Halcyon has documented multiple incidents linked to Codefinger's data extortion campaign against organizations with unsecured infrastructure.

Exploited Vulnerabilities

No exploited CVEs have been attributed to this threat actor yet.

Browse CVE Database