CyberSum logo
Back

Crimson Collective Targets AWS Environments for Data Theft

Cyber Security News by CyberSum.net
3 sources
The Crimson Collective threat group has been targeting AWS cloud environments to steal data and extort companies. They compromised long-term AWS access keys and IAM accounts for privilege escalation, using tools like TruffleHog to discover exposed credentials. After gaining access, they created new IAM users and login profiles, attached 'AdministratorAccess' policies, and enumerated users, instances, and databases. The group then modified RDS master passwords, created snapshots, and exported them to S3 for exfiltration. They sent extortion notes via AWS SES and external email accounts. Rapid7 recommends using short-term, least-privileged credentials and implementing restrictive IAM policies to mitigate these attacks.

Also Read

PhantomVAI Loader: New Multi-Stage .NET Loader in Phishing Campaigns

PhantomVAI Loader, a newly renamed multi-stage .NET loader, is being used in widespread phishing campaigns to deliver various information-stealing malware. The loader, initially identified as Katz Stealer Loader, now supports multiple payloads through an evasive infection chain that includes obfuscated scripts, steganography, and virtual-machine detection. Organizations across multiple sectors have been targeted in this global campaign. The loader is available on underground marketplaces, allowing even low-skill actors to launch complex attacks. The infection chain involves phishing emails with themes of sales, payments, or legal actions, sometimes using homograph attacks to trick recipients. The emails contain ZIP archives with obfuscated JavaScript or VBS files that embed a Base64-encoded PowerShell script, which fetches a GIF file with a steganographically hidden DLL payload. The PhantomVAI Loader performs virtual-machine detection checks and establishes persistence through scheduled tasks or Run registry keys before downloading the final payload and injecting it into a legitimate executable.

By Cyber Security News by CyberSum.net