EC2 Grouper

Executive Summary

EC2 Grouper is a multi‑faceted threat actor that combines cloud‑infrastructure manipulation, zero‑day exploits and supply‑chain attacks to compromise high‑value targets across a wide range of sectors. Using AWS APIs for automated security‑group creation, the group harvests credentials from publicly exposed cloud keys and deploys remote access trojans such as Remcos, Sunburst and Havex RAT to exfiltrate data and elevate privileges. Recent activity shows the exploitation of the CVE‑2013‑3893 client vulnerability and ongoing phishing campaigns aimed at Japanese organizations.

Goals & Targeting

The actor’s primary objective appears to be financial gain through data exfiltration and illicit monetization, supplemented by strategic espionage via supply‑chain compromises. By targeting a broad spectrum—government, defense, telecommunications, healthcare, critical infrastructure, and education—they seek to infiltrate varied environments that house valuable credentials or sensitive data. The repeated focus on Japanese organizations underscores a geopolitical dimension, potentially aimed at gathering competitive intelligence or influencing regional affairs. Strategically, EC2 Grouper blends cloud‑native execution with traditional zero‑day exploits to avoid detection and simplify lateral movement across heterogeneous infrastructures. Credential harvesting from exposed code further indicates a low‑effort but high-reward approach, enabling the exploitation of legitimate AWS services before moving to client‑side attacks. Overall, their targeting profile suggests a hybrid motive: profiteering while opportunistically collecting intelligence that can be later leveraged for political or economic influence.

Key Capabilities

• Phishing campaigns
• Exploitation of publicly disclosed CVEs (CVE-2017-0199, CVE-2024-36401, CVE-2013-3893)
• Remote access trojans – Remcos RAT, Sunburst (SolarWinds), Brute Ratel C4, Havex RAT
• Infostealer payloads such as FormBook
• Supply‑chain attacks on npm packages and third‑party libraries
• Zero‑day vulnerability exploitation (CVE‑2013-3893)
• Targeted attacks against Japanese organizations
• Use of AWS Cloud tools for automated attacks via CreateSecurityGroup API
• Credential acquisition through compromised cloud keys in public code repositories

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

EC2 Grouper’s campaign pattern shows a combination of long‑term infrastructure deployment—such as automated security group creation in the cloud—and episodic zero‑day exploitation, exemplified by the 2013 CVE‑2013‑3893 operation against Japanese targets and more recent CVE‑2024‑36401 exploits. The actor maintains an operational tempo that allows periodic bursts of activity while keeping a low public profile. Victims span critical infrastructure, defense, finance, and educational sectors across Asia, Europe, the Americas, and Middle East, demonstrating geographic flexibility. Their preferred tactics include phishing for initial credential collection, followed by installation of remote access trojans or supply‑chain implants, which provide persistent footholds and extensive lateral movement. Notable operations such as Operation DeputyDog (CVE‑2013‑3893) and the reported supply‑chain compromise of an npm package highlight the group’s capacity to blend classic APT workflows with modern cloud‑native methods. In addition to data exfiltration, the actor appears equipped for sabotage or espionage via its supply‑chain footholds, indicating a multi‑layered threat model that spans both financial and strategic objectives.

IOC Patterns

• Domain
• URL
• File
• CVE identifier: CVE-2013-3893
• Zero‑day exploit

Recommended Actions

• Secure cloud credentials by rotating keys regularly and storing them in a secrets management system separate from public code repositories. Configure AWS GuardDuty or similar monitoring to alert on anomalous CreateSecurityGroup API calls, especially those not accompanied by corresponding AuthorizeSecurityGroupIngress actions. Ensure Windows endpoints are patched against CVE-2013-3893, CVE‑2017‑0199, CVE‑2024‑36401 and other known vulnerabilities; use automated patching tools where possible. Deploy email filtering solutions with attachment sandboxing to block malicious Office documents and JavaScript phishing payloads. Implement strict outbound egress controls and DLP to detect data exfiltration associated with Remcos RAT, Sunburst, Havex, or FormBook activity. Use application whitelisting and behavior analytics to detect rogue RATs and infostealer binaries on endpoints. Apply supply‑chain monitoring—verify npm package checksums, use package signing or a private registry, and conduct code reviews to mitigate compromised dependencies. Block or monitor known malicious domains such as demo-cloud.space, attack.mitre.org, cisa.gov, Temp.* domains listed in IOC sets.