Loading story…
Attackers can exfiltrate data from cloud environments by abusing legitimate cross-account sharing, backup, and replication features instead of moving files over traditional outbound channels. MITRE ATT&CK tracks this behavior as T1537 — Transfer Data to Cloud Account, describing how adversaries use provider APIs and internal cloud networking to make exfiltration resemble normal intra-cloud activity and evade controls focused on internet egress or command-and-control traffic.
Research detailing AWS tradecraft shows attackers with snapshot-related permissions can create Amazon EC2 and Amazon RDS snapshots, share them with attacker-controlled AWS accounts, and recover the underlying data without logging back into the original instance or database. Similar abuse is possible in Amazon S3, where adversaries can alter replication rules or trigger batch replication jobs to copy bucket contents into external accounts, particularly when overly permissive IAM roles are available. The activity largely occurs through cloud control-plane operations, reducing host-level forensic evidence and increasing the importance of monitoring CloudTrail, restricting IAM and KMS permissions, and encrypting sensitive resources.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A technical blog post analyzed how attackers with compromised AWS access can abuse native cross-account features in EC2, RDS, and S3 to move victim data into attacker-controlled AWS accounts with limited host-level forensic traces. The post mapped this behavior to MITRE ATT&CK technique T1537 and outlined mitigations including encryption, tighter IAM/KMS controls, and CloudTrail monitoring.
MITRE ATT&CK documented technique T1537, Transfer Data to Cloud Account, describing how adversaries can exfiltrate data within the same cloud provider by using account-to-account sharing, syncing, or backup transfer mechanisms that may evade traditional exfiltration monitoring.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aryon Security disclosed **"ShutterGap,"** a cloud visibility gap that allows attackers to discover and copy briefly exposed public AWS resources before CSPM and CNAPP scans detect them. The issue stems from customer misconfigurations rather than an AWS flaw and affects public-sharing features for resources including **Amazon RDS snapshots**, **Amazon DocumentDB snapshots**, **Amazon Machine Images (AMIs)**, and **AWS Systems Manager documents**. Aryon reported that many exposures are extremely short-lived: about **20% of public RDS snapshots** were visible for less than two minutes, and **99% of deleted RDS and DocumentDB snapshots** disappeared within 30 minutes of creation. Researchers showed that once a public snapshot is copied into another AWS account, it can be analyzed later even after the owner revokes access, creating a durable data-exposure risk from fleeting mistakes. In a sample of 24 public RDS snapshots, Aryon found **AWS account IDs, email addresses, potential secrets, private-key-related patterns, and signs of financial data**; earlier research by Mitiga similarly found hundreds of exposed public RDS snapshots and identified databases containing **PII, password hashes, tokens, and business data**. The findings underscore that short-lived public sharing can still lead to lasting compromise, and the recommended mitigations include **blocking public sharing where possible, enforcing encryption and least privilege, applying Service Control Policies, and monitoring public-sharing events with CloudTrail, AWS Config, and Trusted Advisor**.
Jul 31, 2026
Ransomware operators are increasingly integrating native Amazon Web Services (AWS) features, such as S3 buckets, compute snapshots, and cloud backup systems, into their attack toolkits to maximize the impact of their campaigns. Recent research highlights that these groups are not only targeting misconfigured cloud storage but are also leveraging built-in AWS capabilities—like encryption management and key rotation—to delete, overwrite, or render data unrecoverable, often bypassing traditional security controls. The attackers exploit customer-provided keys and other advanced cloud-native mechanisms to assert control over cryptographic protections, making recovery efforts significantly more difficult for victims. Trend Micro researchers have identified at least five distinct ransomware variants that exploit AWS S3 misconfigurations for irreversible data destruction. Security experts note that while S3-focused attacks have been observed for years, the current trend marks a shift toward systematic abuse of cloud-native features for extortion. This evolution in tactics underscores the need for organizations to strengthen cloud security postures, particularly around key management, backup strategies, and monitoring for suspicious use of native cloud services.
Jun 29, 2026
The Crimson Collective, a newly identified advanced persistent threat (APT) group, has been observed targeting Amazon Web Services (AWS) environments to steal sensitive data. Security researchers have reported that the group specializes in exploiting leaked AWS Identity and Access Management (IAM) keys, which are often sourced from exposed code repositories or misconfigured cloud environments. Using tools like TruffleHog, the attackers systematically search for and validate AWS credentials that have been inadvertently published or left unprotected. Once a valid access key is identified, the group leverages the GetCallerIdentity API call to confirm its usability and gain initial access to the victim's AWS account. The attackers then establish persistence by creating new IAM users, login profiles, and additional access keys, effectively embedding themselves within the compromised environment. To maximize their control, Crimson Collective attaches the AWS-managed AdministratorAccess policy to these new accounts, granting themselves full administrative privileges. In scenarios where immediate administrative access is not available, the group uses the SimulatePrincipalPolicy API to analyze existing permissions and identify pathways for privilege escalation. This methodical approach allows the attackers to conduct extensive reconnaissance, manipulate cloud resources, and exfiltrate sensitive data without detection. The group’s operations demonstrate a sophisticated understanding of AWS’s internal mechanisms and highlight the risks associated with overly permissive IAM policies. Victims of these attacks face significant threats, including data theft, extortion, and potential disruption of cloud-based services. The incident underscores the importance of securing access credentials, regularly auditing IAM policies, and monitoring for unusual API activity within cloud environments. Security experts recommend immediate revocation of exposed keys, implementation of least-privilege access models, and the use of automated tools to detect credential leaks. The emergence of Crimson Collective signals an escalation in targeted attacks against cloud infrastructure, emphasizing the need for robust cloud security practices. Organizations are urged to review their AWS configurations and ensure that sensitive credentials are never stored in public or unsecured locations. The attack chain employed by Crimson Collective serves as a cautionary example of how mismanaged cloud security can lead to severe breaches. Ongoing investigations aim to determine the full scope of affected organizations and the extent of data exfiltration. The cybersecurity community continues to monitor the group’s activities and share indicators of compromise to help defend against similar threats. This incident highlights the evolving tactics of APT groups in targeting cloud environments and the critical need for proactive defense measures.
Jul 12, 2026