Tag: iam

2 Attack Reports | 0 Vulnerabilities

Attack reports

Crimson Collective: A New Threat Group Observed Operating in the Cloud

Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that it is behind a…
extortion
exfiltration
aws
trufflehog
iam
2025-10-10
crimson collective
amazon web services
valid accounts
s3 bucket
Published: October 10, 2025
Downloadable IOCs: 3

Tales from the cloud trenches: The Attacker doth persist too much, methinks

A leaked AWS access key led to malicious activities over a 150-minute period, involving five distinct IP addresses. The attackers employed both common and innovative tactics, including creating 'persistence-as-a-service' infrastructure, manipulating AWS Identity Center, and disabling organization-l…
persistence
aws
telegram
2025-05-13
cloud-security
api-gateway
identity-center
iam
lambda
Published: May 13, 2025
Downloadable IOCs: 5
Click here to see more Attack Reports