☁️ CLOUD THREAT ANALYSIS • LIVING OFF THE LAND

   

      CLOUD COMPROMISE: Crimson Collective Leverages AWS Services to Stealthily Exfiltrate Massive Volumes of Sensitive Data    

   

By CyberDudeBivash • October 09, 2025 • Threat Intelligence Report

 

      cyberdudebivash.com |       cyberbivash.blogspot.com    

 

 

  Share on X   Share on LinkedIn

 

Disclosure: This is a threat intelligence briefing for cloud security professionals. It contains affiliate links to relevant enterprise security solutions. Your support helps fund our independent research.

  Threat Report: Table of Contents  

   
1. Chapter 1: The New Exfiltration — Hiding in Plain Sight on the AWS Backbone
 
2. Chapter 2: The TTP — Weaponizing the AWS Database Migration Service (DMS)
   
3. Chapter 3: The Defender's Playbook — Hunting for Malicious DMS Activity
   
4. Chapter 4: The Strategic Takeaway — Your Cloud Control Plane is the Battlefield
 

 

Chapter 1: The New Exfiltration — Hiding in Plain Sight on the AWS Backbone

 

Sophisticated cloud threat actors are evolving beyond noisy, custom Command and Control channels. In a new campaign we attribute to a group we're calling **"Crimson Collective,"** attackers are "Living Off the Cloud" in the most dangerous way possible. They are not just using cloud services for C2, as we've seen with the **abuse of AWS X-Ray**; they are weaponizing powerful, legitimate AWS data services to exfiltrate massive volumes of sensitive data at high speed, all while remaining nearly invisible to traditional network security tools.

---

 

Chapter 2: The TTP — Weaponizing the AWS Database Migration Service (DMS)

 

The core of this new TTP is the abuse of the **AWS Database Migration Service (DMS)**, a legitimate and powerful tool designed to move large databases into or within the AWS cloud.

The Kill Chain:

1. **Initial Access:** The attack begins with the compromise of an AWS IAM access key that has been granted `dms:*` permissions.
2. **The Setup:** Instead of downloading data over the public internet, the attacker uses these stolen keys to make a series of legitimate AWS API calls. They configure a new DMS replication task.
3. **The Exfiltration:** The task is configured with a *source endpoint* pointing to the victim's production RDS database, and a *target endpoint* pointing to an RDS database in a separate AWS account controlled by the attacker.
4. **The Impact:** When the task is started, AWS DMS begins a full, high-speed replication of the victim's entire database to the attacker's account. This multi-terabyte data transfer happens entirely within the encrypted AWS backbone, appearing as legitimate service-to-service communication.

---

 

Chapter 3: The Defender's Playbook — Hunting for Malicious DMS Activity

 

Your network firewall is blind to this threat. Detection must be focused on the cloud control plane.

1. Enforce Least Privilege (IAM)

This is the primary preventative control. An IAM role or user should **never** have broad `dms:*` permissions unless it is explicitly and solely for the purpose of database migration. This is a core tenet of the **Shared Responsibility Model**.

2. Hunt in Your CloudTrail Logs

Your AWS CloudTrail logs are the ground truth for all API activity. This is where you will find the evil. Your security team must be actively hunting for the "golden signals" of this attack:

• **`CreateReplicationTask`**
• **`CreateEndpoint`** (especially where the target endpoint ARN belongs to an unknown or external AWS account)
• **`StartReplicationTask`**

The appearance of these API calls from an unexpected user or role is a critical, high-fidelity alert.

---

 

Chapter 4: The Strategic Takeaway — Your Cloud Control Plane is the Battlefield

 

This campaign is a powerful illustration of the future of cloud security. As attackers become more cloud-native, they will increasingly abuse the platform's own powerful services to achieve their objectives. The battlefield is no longer just your network perimeter; it is your cloud control plane.

For CISOs, this means your detection and response strategy must be laser-focused on monitoring the API activity within your cloud environment. A deep understanding of what is "normal" for your cloud APIs and a robust **Cloud Security Posture Management (CSPM)** and threat detection program are no longer optional; they are the fundamental requirements for survival in the cloud.

    Gain Cloud-Native Visibility: A Cloud Native Application Protection Platform (CNAPP) is essential for defending against these TTPs. **Kaspersky Hybrid Cloud Security** provides this unified visibility, combining CSPM to find IAM misconfigurations with CWPP and Cloud Threat Detection to spot anomalous API calls.  

 

Explore the CyberDudeBivash Ecosystem

 

   

      Our Core Services:      

       
• CISO Advisory & Strategic Consulting
       
• Penetration Testing & Red Teaming
       
• Digital Forensics & Incident Response (DFIR)
       
• Advanced Malware & Threat Analysis
       
• Supply Chain & DevSecOps Audits
     

   

   

      Follow Our Main Blog for Daily Threat Intel       Visit Our Official Site & Portfolio    

 

 

   

About the Author

   

CyberDudeBivash is a cybersecurity strategist with 15+ years in cloud security, threat hunting, and incident response, advising CISOs across APAC. [Last Updated: October 09, 2025]

 

  #CyberDudeBivash #CloudSecurity #AWS #ThreatHunting #LivingOffTheCloud #DataExfiltration #CyberSecurity #InfoSec #CISO #ThreatIntel