Crimson Collective Leverages AWS Services to Exfiltrate Sensitive Data

A newly identified threat group, Crimson Collective, has emerged as a cybersecurity concern, targeting Amazon Web Services (AWS) environments with data exfiltration and extortion campaigns.

The group has reportedly compromised Red Hat by stealing private repositories from its GitLab infrastructure. This incident underscores the increasing risks associated with cloud-focused cybercrime.

Crimson Collective employs a structured approach to breach AWS infrastructure, starting with the exploitation of leaked long-term access keys and escalating privileges through IAM account manipulation.

They demonstrate advanced knowledge of AWS services and security configurations , enabling persistent access across compromised environments.

The group's activities focus on exfiltrating databases, project repositories, and other critical organizational data, posing significant risks to corporate intellectual property and customer information.

Security researchers have documented increased activity from Crimson Collective across multiple AWS environments, with incidents reported throughout September.

The group operates from multiple IP addresses and maintains presence across several compromised accounts, indicating a coordinated structure.

An analysis by Rapid7 identified the malware and operational patterns through CloudTrail logs and behavioral indicators. The research revealed that Crimson Collective uses the open-source tool TruffleHog to discover compromised AWS credentials.

Crimson Collective's methodology centers on leveraging TruffleHog to identify exposed credentials. The tool authenticates credentials using the GetCallerIdentity API call to confirm validity.

CloudTrail logs consistently show the TruffleHog user agent as the initial indicator of compromise, allowing security teams to detect intrusions.

Once credentials are validated, the group establishes persistence by creating users and escalating privileges. They execute CreateUser API calls, followed by CreateLoginProfile and CreateAccessKey calls.

The group attempts these persistence mechanisms across all compromised accounts, assessing permissions using SimulatePrincipalPolicy calls on accounts lacking sufficient privileges.

When successful in creating new users, they escalate privileges by attaching the arn:aws:iam::aws:policy/AdministratorAccess policy through AttachUserPolicy API calls. This grants comprehensive access to AWS services, enabling data exfiltration operations.

Based on reporting by Cyber Security News.