Detecting AWS Environment Persistence Threats

The Rapid7 #MDR team has been tracking a new threat group targeting AWS environments for data theft and extortion. Calling themselves Crimson Collective, this group starts by finding leaked long-term AWS access keys using tools like TruffleHog, then creates new IAM users and attaches AdministratorAccess to move laterally and escalate privileges. From there, they map the environment through extensive API calls — ListRoles, DescribeInstances, DescribeSnapshots, DescribeDBClusters — and export RDS and EBS data through S3. In some cases, they’ve even used AWS Simple Email Service from within the victim’s environment to deliver extortion notes. This campaign is another reminder that long-term credentials and overly permissive IAM policies continue to be prime targets for abuse, and that adversaries are getting better at blending in with legitimate cloud operations. 👇 Detailed analysis from the Rapid7 team: https://lnkd.in/eNyy2D2X

Imagine clicking a “Launch Stack” button in an email that looks like it’s from AWS Support. Seems harmless, right? Unfortunately, it’s the start of a sophisticated AWS account takeover attempt. I’ve published a new blog post discussing how attackers are using CloudFormation StackSets in phishing campaigns to target AWS environments. In the blog, I provide actionable advice, including: - Details about this sophisticated threat. - Detecting attacks with CSPM platforms or open-source tools. - Countermeasures to slow down or stop attackers, such as analyzing phishing domains and disrupting their API endpoints. Cloud security threats evolve fast — stay informed, stay sharp, and secure your environment!

Great new work from ServiceNow AI Research on backdoor poisoning of agents. Small amounts of poisoned training data can implant reliable triggers in models that are hard to detect and shake. Remarkably such poisoned data can improve task metrics even as it renders the system more exploitable, a particularly noxious honey trap for teams looking for performance gains. This is AI supply-chain risk. Training data, trace-collection environments, and model weights are all ingress points for poison. Major findings: ▪️ Low-dose, high-yield. Single-digit % poison can produce high attack success when the trigger appears. Attacks don't need to flood the scene to create pathways for exploit. ▪️ Stealth / honey-trap. Backdoors can raise task success while staying exploitable, tempting for teams chasing performance gains. ▪️ Persistence and detection difficulty. Backdoors in base weights can survive clean fine-tuning; string-level filters miss harms that unfold across plans and multi-step traces. The research tested three distinct supply chain threat models: ▪️ Data poisoning: poisoned interaction logs enter SFT. ▪️ Environment poisoning: hidden DOM nodes or tool outputs cause the teacher to record poisoned traces during collection. ▪️ Backdoored base weights: model starts tainted; the trigger survives fine-tuning. Defenses tested: ▪️ Static screening and guardrails: heuristics miss subtle triggers; string classifiers don’t reason over goal, history, next action, so harmful plans look fine at a local level. ▪️ Weight auditors: helpful but brittle; can't replace behavioral testing with realistic tools/triggers. Concrete takeaways for teams deploying: ▪️ Defend with a Swiss-cheese posture. Aim for multiple layers that diverge in assumptions, type (e.g., provenance, hardened collection, weight intake checks, runtime action gates) so the holes in each layer don’t line up. ▪️ Provenance practices: require attestations; quarantine traces with hidden markup, odd tool strings, invisible characters. ▪️ Harden trace collection practices: instrument for DOM diffs and injected outputs; log, quarantine, retrain. ▪️ Weight intake checks: treat third-party checkpoints like untrusted binaries; run backdoor drills (trigger sweeps, action audits) before promoting to production. ▪️ Runtime governance: gate sensitive tools behind contextual allowlists and stateful judges comparing the next action to the goal and history. ▪️ We need to up our game on metrics: move beyond ASR to task success, stealth, time to exploit, etc. ▪️ Ablate architectural layers: keep layers that improve security without degrading utility. ▪️ Containment by default: limit blast radius with tool scopes, rate limits, human-in-the-loop on high-risk actions. Link to paper in comments. Big props to the authors Léo Boisvert Abhay Puri Chandra Kiran Reddy Evuru Nicolas Chapados Quentin Cappart Alexandre Lacoste Krishnamurthy Dvijotham Alexandre Drouin #aisecurity #cybersecurity #trustworthyai ServiceNow

🚨 ☁️ - New Recorded Future Insikt Group report! This is essential reading for anyone building or defending in modern hybrid, SaaS-heavy, or cloud-native environments. The report outlines a clear and uncomfortable reality: cloud environments are now central to how threat actors operate, not just a peripheral target. Please read and share with your networks! Our analysis highlights five key threat vectors shaping the current cloud threat landscape: cloud abuse, exploitation, endpoint misconfiguration, cloud ransomware, and credential abuse. What emerges is a picture of attackers who are not only exploiting misconfigured or vulnerable infrastructure but actively adopting cloud-native tooling and services for persistence, evasion, and impact. 🔑 Cloud abuse, in particular, is no longer rare — it’s routine. Threat actors are standing up their own infrastructure in AWS, Azure, Google Cloud, and even lesser-known providers, blending in with legitimate traffic to host C2 nodes, phishing kits, and credential harvesting sites. In some cases, they’re compromising victim cloud environments directly to mine cryptocurrency, exfiltrate data, or abuse expensive APIs like those tied to large language models — a tactic now known as “LLMjacking.” Initial access often starts with the usual suspects: misconfigured endpoints and exposed secrets or credentials, many of which are still discovered en masse through open-source scanners and repos. Credential abuse remains a direct path to full-tenant compromise, especially in environments lacking basic protections like passwordless auth or adaptive MFA. Threat actors have shown a growing ability to escalate privileges and maintain access by manipulating identity federation, forging SAML tokens, and abusing synchronization accounts — making cloud identity a persistent battleground. What makes this report especially valuable is that it doesn’t stop at threat modeling. It provides practical, grounded mitigation and detection strategies aligned to each phase of the attack chain. These include monitoring for suspicious cloud API usage, spotting unauthorized data exfiltration via storage buckets, detecting anomalous access patterns, and reinforcing controls over third-party and federated identities. It also urges organizations to revisit assumptions around visibility — many cloud compromises go unnoticed until the financial or operational damage is done, and native logging alone isn’t enough to catch sophisticated misuse. What’s most striking, though, is the strategic shift underway. Threat actors increasingly rely on cloud infrastructure not just as a target, but as a core part of their kill chain. As adoption accelerates, the question isn’t if cloud infrastructure will be targeted — it’s how much of your detection, logging, and identity controls are ready for when it is. Because at this stage, the cloud isn’t just someone else’s computer — it’s someone else’s kill chain.

As a SOC engineer, your responsibility is to enhance detection and prevention controls within your environment. However, this cannot be achieved without first identifying the blind spots in your environment. Consider a scenario where an attacker gains access to your AWS account and attempts to create a Lambda function, then modifies its resource-based policy to allow lambda:InvokeFunction from an external AWS account. Would your current setup be able to prevent or detect such a backdoor? To address this, it might be helpful to break the issue down into several sub-questions, such as: 1-Which IAM roles or users are authorized to create and update Lambda functions? 2-Do you have any SCPs or restrictions that prevent Lambda functions from being modified to allow invocation from external AWS accounts? 3-Is there an approval process, policy, or exception-handling procedure in place for such cases? 4-Can you list all Lambda functions that are configured to be invoked externally? 5-Are you able to differentiate between internal and external Lambda invocations? 6-Would you receive a notification in the event of an external invocation? Is IAM Access Analyzer enabled in your environment? 7-Do you have an incident response playbook for handling such scenarios? This highlights the power of purple teaming activities in an AWS environment. By simulating real-world attack scenarios like this, you can proactively identify blind spots, enhance your detection and prevention mechanisms, and improve critical aspects such as change management processes, incident response playbooks, IAM roles, SCP policies, IAM Access Analyzer configurations, and logging. #PurpleTeaming #Backdoor #CloudSecurity #AWS

⚠️ If you're running workloads in AWS, this one’s worth your attention. Bleeping Computer just covered how a group called Crimson Collective is targeting AWS environments for data exfiltration: 🚨 Highlights from the report: Claimed theft of 570GB of data from 28,000+ GitLab repos. Included infrastructure diagrams, auth tokens, DB credentials Attack path: 1. Steal or abuse long-lived AWS credentials 2. Create IAM users, roles, or login profiles 3. Escalate privileges by attaching policies (e.g. AdministratorAccess) 4. Spin up EC2 or snapshot RDS/EBS for data extraction 5. Offload data via S3 or open SGs 6. Modify RDS passwords or use SES for extortion ** No exploits needed, just native AWS behavior and over-permissive IAM. Key IAM permissions that enable this: - iam:CreateRole, AttachRolePolicy, PutRolePolicy - UpdateAssumeRolePolicy, AddRoleToInstanceProfile - CreatePolicy, CreatePolicyVersion Most teams try to police this with detections, reviews, or least privilege guidelines. It’s reactive, and gaps are inevitable. But there’s a better path: default deny + just-in-time access. Restrict sensitive IAM actions unless explicitly approved, and eliminate standing privilege. This attack is a reminder: you don’t need a vulnerability to get breached, you just need bad IAM hygiene. 👀 If you haven’t reviewed who can pass roles, create policies, or snapshot volumes lately… now’s a good time. Ping me if you want to walk through architecture options. Always happy to help. Link to article with more details: https://lnkd.in/eQkaZXcS #AWS #IAM #CloudSecurity #Breach #TheyJustLogin

Recently, AWS disclosed information about the in-house threat intelligence technologies employed to automatically protect its infrastructure against various cyber threats. This intelligence is also made available to customers in security tools like AWS Shield, AWS WAF, and Amazon GuardDuty. Here are 3 recent examples: ▶ MadPot: A network of sensors that mimic potential targets to attract and observe threat actors. MadPot processes over 100 million potential threat interactions daily, identifying about 500,000 as malicious. The system then analyzes this data to gain insights into threat actors' tactics and techniques, helping AWS to detect, monitor, and disrupt cyber threats. https://lnkd.in/dScjE929 ▶ Mithra: A massive internal neural network graph model, with 3.5 billion nodes and 48 billion edges, that assigns reputation scores to domain names, helping identify malicious domains that AWS customers interact with. It processes up to 200 trillion DNS requests per day in a single AWS Region and detects an average of 182,000 new malicious domains daily. Notably, Mithra can predict malicious domains days, weeks, or even months before they appear on third-party threat intelligence feeds. This capability enhances AWS security services like GuardDuty, reduces false positives in threat detection, and provides valuable context for security investigations, allowing AWS to offer more accurate and timely protection against emerging threats. https://lnkd.in/deMdSnh5 ▶ Sonaris: A network telemetry analyzer, that identifies and blocks malicious attempts to connect to multiple customer accounts in search of vulnerabilities. In 12 months, Sonaris demonstrated its effectiveness by denying over 24 billion attempts to enumerate S3 buckets and preventing nearly 2.6 trillion attempts to discover vulnerable services running on customers' Amazon EC2 virtual servers. https://lnkd.in/dU5Vxs-D Follow me for similar posts about AWS and cyber security. #aws #cybersecurity #waf #cloudfront

Are you prepared for the storm that may be brewing in your cloud environment?  With the right tools and strategies, you can secure your assets and fortify your defenses. Here’s your Advanced Cloud Security Audit Checklist using open-source tools:  ➡️ Cloud Resource Inventory Management   - Use CloudMapper to discover and map all cloud assets.   - Ensure accurate asset tracking for security visibility.  ➡️ IAM Configuration Analysis   - Audit IAM policies with PMapper to identify risks.   - Enforce least privilege access to minimize the attack surface.  ➡️ Data Encryption Verification   - Validate encryption protocols with OpenSSL & AWS KMS.   - Ensure data encryption at rest and in transit.  ➡️ Network Security & Vulnerability Assessment   - Scan security groups & NACLs using Scout2 or Prowler.   - Detect unintended access points and misconfigurations.  ➡️ API Security & Vulnerability Scanning   - Test API authentication with OWASP ZAP or APIsec.   - Identify API weaknesses and prevent unauthorized access.  ➡️ Cloud Penetration Testing & Vulnerability Scanning   - Continuously scan for vulnerabilities using OpenVAS or Nessus.   - Detect and remediate security flaws in cloud infrastructure.  ➡️ IaC Security Auditing   - Review Terraform & CloudFormation with Checkov.   - Detect misconfigurations before deployment.  ➡️ Logging & Cloud Activity Monitoring   - Aggregate security logs using ELK Stack or Wazuh.   - Perform anomaly detection to spot suspicious activity.  ➡️ Cloud Compliance & Regulatory Monitoring   - Automate security compliance checks with Cloud Custodian.   - Ensure adherence to GDPR, HIPAA, and SOC 2 standards.  ➡️ Audit Trail & Incident Response   - Monitor cloud logs using AWS CloudTrail or Google Audit Logs.   - Track administrative activity and detect threats early.  ➡️ MFA Enforcement & Audit   - Verify MFA settings across critical accounts.   - Enforce multi-factor authentication using MFA Checker.  ➡️ Cloud Backup & Disaster Recovery   - Perform integrity checks using Duplicity or Restic.   - Validate recovery point objectives (RPO) and test restores.  Follow Satyender Sharma for more insights !

🚨 𝗡𝗲𝘄 𝗔𝗪𝗦 𝗚𝘂𝗮𝗿𝗱𝗗𝘂𝘁𝘆 𝗟𝗮𝗯𝘀 𝗝𝘂𝘀𝘁 𝗗𝗿𝗼𝗽𝗽𝗲𝗱 🚨 I've just added a new section to my AWS Security Cookbook covering 𝗔𝗪𝗦 𝗚𝘂𝗮𝗿𝗱𝗗𝘂𝘁𝘆, along with 𝘁𝗵𝗿𝗲𝗲 𝗳𝗿𝗲𝗲 𝗵𝗮𝗻𝗱𝘀-𝗼𝗻 𝗹𝗮𝗯𝘀 to help you build practical skills: 📚 𝗢𝘃𝗲𝗿𝘃𝗶𝗲𝘄: 𝗔𝗪𝗦 𝗚𝘂𝗮𝗿𝗱𝗗𝘂𝘁𝘆 Learn how GuardDuty works, how to deploy it across an AWS Organization, interpret findings, enable additional protections, and log findings for analysis. 🧪 𝗟𝗮𝗯 𝟭: 𝗗𝗲𝗽𝗹𝗼𝘆𝗶𝗻𝗴 𝗚𝘂𝗮𝗿𝗱𝗗𝘂𝘁𝘆 𝘄𝗶𝘁𝗵 𝗧𝗲𝗿𝗿𝗮𝗳𝗼𝗿𝗺 Walk through deploying GuardDuty across accounts using Terraform, generate sample findings, and explore the console to understand detection summaries. 🧪 𝗟𝗮𝗯 𝟮: 𝗟𝗼𝗴𝗴𝗶𝗻𝗴 𝗚𝘂𝗮𝗿𝗱𝗗𝘂𝘁𝘆 𝗙𝗶𝗻𝗱𝗶𝗻𝗴𝘀 𝘁𝗼 𝗦𝟯 Learn how to persist GuardDuty findings in S3 for long-term storage and integration with your SIEM or other security tooling. 🧪 𝗟𝗮𝗯 𝟯: 𝗔𝗱𝘃𝗲𝗿𝘀𝗮𝗿𝘆 𝗦𝗶𝗺𝘂𝗹𝗮𝘁𝗶𝗼𝗻 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝘄𝗶𝘁𝗵 𝗦𝘁𝗿𝗮𝘁𝘂𝘀 𝗥𝗲𝗱 𝗧𝗲𝗮𝗺 𝗮𝗻𝗱 𝗚𝘂𝗮𝗿𝗱𝗗𝘂𝘁𝘆 Simulate real-world attack techniques using Stratus Red Team and observe how GuardDuty detects them (or doesn't!). This lab helps you understand which tactics trigger findings and how to improve your detection coverage. 👉 Link in comments to check it out #aws #awssecurity #cloudsecurity #cybersecurity #cloudsecurityengineer