Crimson Collective is an emerging cyber threat group that has recently focused on cloud environments, particularly targeting AWS instances, cloud-based GitLab deployments, and other critical enterprise cloud infrastructure. Their observed activity indicates that the group has evolved from opportunistic attacks into highly targeted campaigns leveraging stolen credentials, misconfigured cloud resources, and supply chain access to infiltrate enterprise networks. Over the past few months, the collective has been linked to data exfiltration incidents impacting organizations in North America, Europe, and Asia, including high-value technology and software development sectors. High profile victims such as Nintendo have been allegedly targeted for example.
The group’s operations allow attackers to gain unauthorized access to sensitive source code repositories, cloud storage, and internal documentation, enabling both financial extortion and strategic theft of intellectual property. These campaigns have led to significant operational disruption, reputational damage, and potential compliance violations for affected organizations.
Get your FREE Community Account today on the HUNTER Platform and get access to behavioral threat hunting content for your SIEM, EDR, NDR, and XDR platforms!
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Relational Database Service (RDS) environment.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS network configuration and infrastructure.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Elastic Compute Cloud (EC2) environment.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Identity and Access Management (IAM), Elastic Compute Cloud (EC2), Elastic Block Store (EBS), Simple Storage Service (S3), Network, Relational Database Service (RDS), Monitoring and Alerts, Messaging, and Application services and infrastructure.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Messaging services.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Simple Storage Service (S3) environment.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Application services.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Monitoring and Alert services.
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Elastic Block Stores (EBS).
This Hunt Package identifies activity that could be associated with discovery behaviors targeting AWS Identity and Access Management (IAM).
QuimaRAT is a newly identified Java-based Remote Access Trojan (RAT) that is being marketed under a Malware-as-a-Service (MaaS) model, and providing threat actors with a cross-platform remote access framework capable of targeting Windows, Linux, and macOS systems.
Gentlemen ransomware uses credential abuse, defense evasion, and double extortion tactics to compromise enterprise environments and increase pressure on victims.
TeamPCP is exploiting trusted npm and PyPI packages to compromise developer environments, steal credentials, and extend attacks across software supply chains.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.