What about attacks that use no ransomware binary, such as the Codefinger attack?

In January 2025, attackers used compromised AWS credentials to encrypt S3 bucket data with AWS’s own SSE-C encryption and an attacker-held key. No ransomware binary executed and no endpoint was involved. Because Elastio inspects the data itself rather than the process that encrypted it, attacks like this are still detectable.

Last updated May 27, 2026