Crimson Collective Exploits AWS Services to Steal Sensitive Data

A newly identified threat group called Crimson Collective has emerged as a significant security concern for organisations using Amazon Web Services (AWS), pursuing data theft and extortion through the cloud. The group reportedly begins by compromising long-term access keys and uses TruffleHog, a legitimate tool, for malicious reconnaissance; after GetCallerIdentity confirms credentials, they establish persistence by creating new users and login profiles.

They then escalate privileges by attaching the AdministratorAccess policy and systematically map AWS infrastructure, including EC2, EBS, RDS, VPCs and IAM roles, while assessing SES and SMS quotas for potential phishing campaigns.

In a multi‑vector data exfiltration phase, they modify live RDS master passwords, create DB snapshots, export data to S3, attach compromised EBS volumes to their own EC2 instances, and finally exfiltrate by GetObject from S3, delivering extortion demands via the victim’s AWS SES and external email accounts. According to Rapid7, the group has shown increased activity and was linked to breaching Red Hat’s private GitLab repositories, with activity observed in September across several incidents.

The security implications emphasise eliminating long‑term keys, tightening IAM permissions, and monitoring CloudTrail for unusual credential and data‑access patterns.