What about attacks that use no ransomware binary, such as the Codefinger attack?

In January 2025, attackers used compromised AWS credentials to encrypt S3 bucket data with AWS’s own SSE-C encryption and an attacker-held key. No ransomware binary executed and no endpoint was involved. Because Elastio inspects the data itself rather than the process that encrypted it, attacks like this are still detectable.