Crimson Collective APT Uses Leaked IAM Keys to Hijack AWS Accounts for Data Theft

SecurityOnline[.]info reports that Rapid7 researchers identified a new threat group named Crimson Collective, which has been attacking AWS environments to exfiltrate data and extort victims. The attackers begin by abusing leaked long-term AWS access keys found with the help of the open-source tool TruffleHog, then verify credentials using GetCallerIdentity.

According to Rapid7, they establish persistence by creating new IAM users and access keys with CreateUser, CreateLoginProfile, and CreateAccessKey, and test privilege boundaries with SimulatePrincipalPolicy, sometimes attaching the AdministratorAccess policy to gain full control. They enumerate assets across EC2, RDS, S3, VPCs and CloudWatch alarms, using commands such as DescribeInstances, DescribeDBSnapshots, and GetCostAndUsage to map the environment.

For exfiltration, they modify RDS master passwords via ModifyDBInstance, create DB snapshots, and export them to S3, then attach EBS snapshots to new EC2 instances to facilitate data leakage, ultimately using SES to send extortion notes from the victim’s own infrastructure. The findings, published on 9 October 2025, describe Crimson Collective as a cloud-native actor focused on data theft and extortion rather than ransomware.