TruffleNet BEC Campaign - AWS SES Credential Abuse

TruffleNet BEC campaign weaponizes stolen AWS credentials to hijack Amazon Simple Email Service for large-scale business email compromise targeting the oil and gas sector. FortiGuard Labs uncovered an attack infrastructure spanning more than 800 unique hosts across 57 Class C networks, all coordinated to abuse AWS SES once valid access keys are obtained. The operation begins with TruffleHog, an open-source secret-scanning tool, systematically validating compromised credentials harvested from exposed repositories, WordPress installations, and misconfigured cloud resources. After confirming credential validity through GetCallerIdentity and GetSendQuota API calls, attackers pivot to identity creation and DKIM key theft from previously compromised domains. By invoking the CreateEmailIdentity API with stolen cryptographic keys, adversaries configure AWS SES to send emails that appear to originate from legitimate companies, bypassing traditional email authentication checks. The infrastructure demonstrates consistent technical fingerprints, including specific port configurations and widespread Portainer container management deployments, suggesting purpose-built attack tooling. The campaign culminated in targeted invoice fraud against oil and gas companies, with attackers impersonating ZoomInfo and requesting $50,000 ACH payments to typosquatted domains. FortiCNAPP successfully detected the operation through composite behavioral analysis, correlating anomalous cloud connections, suspicious automation, and offensive tool usage into high-confidence alerts that enabled rapid response.