A new hacker group named Crimson Collective is using legitimate AWS tools in clever ways to steal data and extort cloud-based organizations.
Quick Summary – TLDR:
- Crimson Collective targets AWS environments using stolen access keys and built-in cloud tools
- The group uses TruffleHog to find credentials and escalates privileges with IAM policy abuse
- Sensitive data is exfiltrated via AWS services like S3, RDS, and EBS before extortion emails are sent
- Rapid7 and security researchers warn this trend marks a dangerous shift in cloud-native cyberattacks
What Happened?
Security researchers from Rapid7 and other cybersecurity firms have identified a threat actor group called Crimson Collective that is targeting organizations running on Amazon Web Services (AWS). The attackers are using advanced techniques to steal sensitive information and then demanding ransom by threatening to expose the data. The group recently claimed responsibility for breaching Red Hat’s private GitLab repositories.
🚨 Rapid7 has observed increased activity involving a new threat group and #AWS cloud environments.
— Rapid7 (@rapid7) October 7, 2025
Self-referred to as ‘Crimson Collective’, the group has claimed responsibility for the recent theft of private repositories from the #RedHat GitLab. More: https://t.co/orTMJxLEq5 pic.twitter.com/KFfeUbAHcP
Attackers Use AWS Tools Against Itself
Crimson Collective has drawn attention for their sophisticated and organized approach to breaching cloud environments. They begin by hunting for exposed long-term AWS access keys, often found in misconfigured code repositories. To locate these secrets, the group abuses TruffleHog, a tool originally built for defensive security.
Once credentials are identified and verified using the GetCallerIdentity API call, they move swiftly to establish persistent access. This includes creating new users and login profiles using AWS’s own Identity and Access Management (IAM) APIs like CreateUser and CreateLoginProfile.
Privilege Escalation and Full Cloud Takeover
After gaining a foothold, Crimson Collective moves to elevate their privileges within the compromised AWS environment. In many cases, they attach the AdministratorAccess policy to new users via the AttachUserPolicy API, giving themselves unrestricted access.
When this direct route is blocked, they pivot by simulating policy evaluations using SimulatePrincipalPolicy, identifying paths for lateral movement or privilege escalation. Their understanding of AWS internals suggests a highly experienced and methodical team.
- IAM API calls: CreateUser, CreateAccessKey, AttachUserPolicy
- Reconnaissance: ListRoles, ListBuckets, DescribeInstances, DescribeDBInstances
- Privilege escalation: SimulatePrincipalPolicy, GetUser, ListPolicies
Deep Recon and Resource Mapping
Crimson Collective conducts extensive reconnaissance once inside, using dozens of enumeration commands across AWS services. Their focus includes:
- EC2 instances and EBS volumes to identify virtual machines and attached storage.
- RDS databases including production workloads.
- VPCs, subnets, security groups, and other key network components.
- Amazon SES and SMS quotas, indicating potential for large-scale phishing.
This step allows them to map out high-value assets such as proprietary data, customer records, and intellectual property.
Stealing Data from the Cloud
With admin-level access, the attackers shift to data exfiltration. They reset passwords using the ModifyDBInstance API to access RDS databases directly, then use CreateDBSnapshot and StartExportTask to clone and export this data to S3 buckets.
In parallel, they copy EBS volumes using CreateSnapshot and AttachVolume, mounting them on attacker-controlled EC2 instances. These instances are spun up using permissive security groups to allow unrestricted access.
Finally, data is pulled from S3 using GetObject, and transferred outside the victim’s infrastructure.
Extortion with a Cloud Twist
Once data is in their hands, Crimson Collective sends extortion demands. Interestingly, they often use the victim’s own Amazon Simple Email Service (SES) to issue the threats, showing complete control over the compromised environment.
Researchers observed that they refer to themselves as “we” in communications and often operate from the same IP addresses across incidents. This organized behavior has led experts to believe that the group operates as a coordinated criminal enterprise rather than isolated individuals.
Red Hat Breach Raises Alarm
Among the known victims is Red Hat, whose private GitLab repositories were compromised. This incident signals a worrying trend of targeting development pipelines, where source code, API keys, and intellectual property may be vulnerable.
Crimson Collective’s primary targets include:
- Internal databases and repositories.
- Production infrastructure.
- Cost and usage data to locate valuable assets.
How to Stay Protected?
Security experts strongly recommend the following steps to defend against similar attacks:
- Eliminate long-term AWS access keys in favor of short-lived IAM roles.
- Apply least privilege principles across IAM policies.
- Restrict sensitive APIs by IP address, where possible.
- Scan code repositories for exposed credentials regularly.
- Monitor CloudTrail logs for suspicious activity like unusual user creation or snapshot operations.
Rapid7 confirms that its InsightIDR and Managed Detection and Response (MDR) solutions already include coverage for the group’s known behaviors.
SQ Magazine’s Takeaway
Honestly, what makes Crimson Collective so dangerous is how they’re flipping AWS’s own tools against users. They are not using flashy malware or complicated exploits. Instead, they’re exploiting bad credential practices and weak IAM policies, which are surprisingly common in cloud setups. As someone who follows cloud security closely, this is a wake-up call for every dev team out there. If you’re still using hardcoded AWS keys in your repos, it’s time to fix that yesterday.
