☁️ CLOUD THREAT ANALYSIS • LIVING OFF THE LAND

CLOUD COMPROMISE: Crimson Collective Leverages AWS Services to Stealthily Exfiltrate Massive Volumes of Sensitive Data

By CyberDudeBivash • October 09, 2025 • Threat Intelligence Report

cyberdudebivash.com | cyberbivash.blogspot.com

Disclosure: This is a threat intelligence briefing for cloud security professionals. It contains affiliate links to relevant enterprise security solutions. Your support helps fund our independent research.

Threat Report: Table of Contents

Chapter 1: The New Exfiltration — Hiding in Plain Sight on the AWS Backbone

Sophisticated cloud threat actors are evolving beyond noisy, custom Command and Control channels. In a new campaign we attribute to a group we’re calling **”Crimson Collective,”** attackers are “Living Off the Cloud” in the most dangerous way possible. They are not just using cloud services for C2, as we’ve seen with the **abuse of AWS X-Ray**; they are weaponizing powerful, legitimate AWS data services to exfiltrate massive volumes of sensitive data at high speed, all while remaining nearly invisible to traditional network security tools.

Chapter 2: The TTP — Weaponizing the AWS Database Migration Service (DMS)

The core of this new TTP is the abuse of the **AWS Database Migration Service (DMS)**, a legitimate and powerful tool designed to move large databases into or within the AWS cloud.

The Kill Chain:

**Initial Access:** The attack begins with the compromise of an AWS IAM access key that has been granted `dms:*` permissions.
**The Setup:** Instead of downloading data over the public internet, the attacker uses these stolen keys to make a series of legitimate AWS API calls. They configure a new DMS replication task.
**The Exfiltration:** The task is configured with a *source endpoint* pointing to the victim’s production RDS database, and a *target endpoint* pointing to an RDS database in a separate AWS account controlled by the attacker.
**The Impact:** When the task is started, AWS DMS begins a full, high-speed replication of the victim’s entire database to the attacker’s account. This multi-terabyte data transfer happens entirely within the encrypted AWS backbone, appearing as legitimate service-to-service communication.

Chapter 3: The Defender’s Playbook — Hunting for Malicious DMS Activity

Your network firewall is blind to this threat. Detection must be focused on the cloud control plane.

1. Enforce Least Privilege (IAM)

This is the primary preventative control. An IAM role or user should **never** have broad `dms:*` permissions unless it is explicitly and solely for the purpose of database migration. This is a core tenet of the **Shared Responsibility Model**.

2. Hunt in Your CloudTrail Logs

Your AWS CloudTrail logs are the ground truth for all API activity. This is where you will find the evil. Your security team must be actively hunting for the “golden signals” of this attack:

**`CreateReplicationTask`**
**`CreateEndpoint`** (especially where the target endpoint ARN belongs to an unknown or external AWS account)
**`StartReplicationTask`**

The appearance of these API calls from an unexpected user or role is a critical, high-fidelity alert.

Chapter 4: The Strategic Takeaway — Your Cloud Control Plane is the Battlefield

This campaign is a powerful illustration of the future of cloud security. As attackers become more cloud-native, they will increasingly abuse the platform’s own powerful services to achieve their objectives. The battlefield is no longer just your network perimeter; it is your cloud control plane.

For CISOs, this means your detection and response strategy must be laser-focused on monitoring the API activity within your cloud environment. A deep understanding of what is “normal” for your cloud APIs and a robust **Cloud Security Posture Management (CSPM)** and threat detection program are no longer optional; they are the fundamental requirements for survival in the cloud.

Gain Cloud-Native Visibility: A Cloud Native Application Protection Platform (CNAPP) is essential for defending against these TTPs. **Kaspersky Hybrid Cloud Security** provides this unified visibility, combining CSPM to find IAM misconfigurations with CWPP and Cloud Threat Detection to spot anomalous API calls.

Explore the CyberDudeBivash Ecosystem

Our Core Services:

CISO Advisory & Strategic Consulting
Penetration Testing & Red Teaming
Digital Forensics & Incident Response (DFIR)
Advanced Malware & Threat Analysis
Supply Chain & DevSecOps Audits

Follow Our Main Blog for Daily Threat Intel Visit Our Official Site & Portfolio

About the Author

CyberDudeBivash is a cybersecurity strategist with 15+ years in cloud security, threat hunting, and incident response, advising CISOs across APAC. [Last Updated: October 09, 2025]

#CyberDudeBivash #CloudSecurity #AWS #ThreatHunting #LivingOffTheCloud #DataExfiltration #CyberSecurity #InfoSec #CISO #ThreatIntel

Cyberdudebivash