Have you ever wondered what lies behind a phishing email? That may be the tip of the iceberg of a more complex dark economy of stolen cloud accounts to abuse email services. Illicitly buying compromised accounts with Amazon Simple Email Service (SES) ready to use is like having access to a phishing weapon that can be immediately leveraged against thousands of users.
Join us in an insightful session that will bring light to the lucrative market for Amazon SES Accounts and uncover an offensive operation where the AWS account of a compromised organization is used to send phishing emails. We will share the techniques and tactics of the two threat actors involved: an Indonesian group that took over AWS accounts with Amazon SES enabled, and a French threat actor who later bought these accounts to launch a phishing campaign against French travel card users. Furthermore, we will talk about the multiple impacts of this attack.
During the talk, we will reveal new detection methods we employed to detect events that are not logged in CloudTrail, specifically the APIs to send emails. Our procedure involves Amazon Simple Notification Service, CloudWatch and Lambda functions to log email events, configure alerts and implement incident response.
Having the complete picture of the dark market and threat actors behind phishing emails in cloud-native environments allows defenders to neutralize those attacks more easily.