Crimson Collective

Executive Summary

Crimson Collective is a financially driven cyber‑criminal group that leverages cloud infrastructures—particularly AWS—for data exfiltration and extortion. In September 2025 they announced a massive breach of Red Hat’s private GitHub repositories, claiming 570 GB and dozens of customer engagement reports. Their tactics combine credential theft, privilege escalation, and the use of native cloud services to stealthily move laterally and exfiltrate data while demanding ransoms via Amazon SES.

Goals & Targeting

The actor’s primary objective is monetary gain via a hybrid model of ransomware and data‐theft‑extortion. By compromising long‑term IAM credentials they can establish persistent, high‑privilege access to target AWS environments where they identify valuable data stored in RDS, S3, or other services. Target selection focuses on large enterprises with complex cloud footprints—particularly those operating in finance, healthcare, retail and defense sectors across the U.S., France and Japan—to maximize payout potential while minimizing exposure and increasing the likelihood of a profitable ransom negotiation.

Key Capabilities

• Compromise long‑term IAM access keys to gain persistence
• Create new IAM users or attach permissive policies for privilege escalation
• Recon within compromised AWS environments to identify valuable data stores
• Exfiltrate data by exporting RDS snapshots to S3 buckets using native services
• Leverage Amazon SES to deliver extortion notes and orchestrate ransomware campaigns
• Discover leaked credentials with TruffleHog across code repositories
• Deploy AI‑powered Softr phishing pages targeting Microsoft Exchange/OWA
• Exploit Cisco CVE‑2025‑20393 and CVE‑2023‑20198 to increase foothold
• Abuse exposed WinRM ports for lateral movement
• Conduct active scanning of target firewalls (e.g., ASA) to locate vulnerable services

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Crimson Collective operates on a repeatable framework that capitalizes on cloud misconfigurations and public‑facing services. Campaigns are typically initiated with credential discovery using TruffleHog, followed by stealthy lateral movement within AWS and the exploitation of exposed management interfaces such as WinRM and WorkMail. Data harvesting is performed via native snapshot exports to S3, and exfiltration is complemented by malicious web service usage (SNS/SSE) or direct transfer to staging buckets. The group has demonstrated repeat attacks against Red Hat’s customers and is suspected to maintain a partnership network that includes other ransomware labs for data‑theft‑extortion operations. Victims are mainly large enterprises in high‑value sectors across the U.S., France, and Japan, with an operational tempo of several weeks per engagement.

IOC Patterns

• Leaked AWS long‑term access keys discovered via TruffleHog
• IAM privilege escalation by creating new users or attaching permissive policies
• RDS master password changes via ModifyDBInstance API
• Exporting RDS snapshots to S3 buckets for data exfiltration
• Abnormal Amazon SES email traffic used for extortion notes
• Exploitation of CVE‑2025‑20393 and CVE‑2023‑20198 in Cisco products
• Open WinRM ports exposed on the internet
• Use of auxiliary SES accounts to send legit-looking phishing emails
• Credential harvesting AI pages via Softr

Recommended Actions

• Enforce least privilege on IAM roles; block long‑term access keys in favor of STS temporary credentials
• Enable IAM guardrails to detect creation of new users or privilege escalation attempts
• Restrict ModifyDBInstance and other sensitive RDS permissions; monitor snapshot export activity to S3 buckets
• Audit and secure S3 bucket policies used for data staging and exfiltration
• Monitor SES usage for anomalous email send rates or ransom note patterns
• Patch vulnerabilities CVE‑2025‑20393 and CVE‑2023‑20198 immediately; harden Cisco assets
• Secure WinRM ports; restrict inbound access to essential services only
• Deploy advanced email filtering, anti‑phishing, and AI‑based credential harvesting detection solutions
• Implement continuous monitoring of cloud resource changes using native audit logs and SIEM integration

Suggested Tags