CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Crimson Collective Targets AWS Environments

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The emerging threat group Crimson Collective, linked to the Red Hat breach, targets AWS environments to steal data and extort organizations. The group uses open-source tools to find leaked AWS credentials and escalate privileges. They have ties to Scattered Spider and LAPSUS$ collectives and operate as an extortion-as-a-service (EaaS) group. Crimson Collective has been observed compromising long-term access keys and leveraging privileges attached to compromised IAM accounts. They create new users, escalate privileges, and exfiltrate valuable data via AWS services. Successful data exfiltration often results in extortion demands.

Timeline

  1. 09.10.2025 15:16 1 articles · 5h ago

    Crimson Collective Targets AWS Environments

    Crimson Collective, linked to the Red Hat breach, has been observed targeting AWS environments to steal data and extort organizations. The group uses open-source tools to find leaked AWS credentials and escalate privileges. They have ties to Scattered Spider and LAPSUS$ collectives and operate as an extortion-as-a-service (EaaS) group. The group's activities include compromising long-term access keys, creating new users, and exfiltrating valuable data via AWS services. Successful data exfiltration often results in extortion demands.

    Show sources
    Open in new tab

Information Snippets