From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover

Impact

For European organizations, this threat poses a substantial risk to both confidentiality and operational integrity. The phishing campaign's focus on tax-related lures is particularly relevant in Europe, where tax compliance and reporting are critical and often complex. Successful credential theft could lead to unauthorized access to sensitive financial and personal data, resulting in data breaches, financial fraud, and reputational damage. The abuse of SES to send phishing emails from seemingly legitimate domains can undermine trust in corporate communications and increase the likelihood of successful social engineering attacks.

Moreover, the use of compromised AWS keys highlights the risk of cloud infrastructure abuse, which can lead to indirect costs such as increased cloud service charges, blacklisting of legitimate domains, and disruption of email communications. European organizations relying heavily on AWS SES for transactional or marketing emails may face challenges in detecting and mitigating such abuse promptly. The campaign also raises concerns about the security posture of organizations' cloud credentials and the effectiveness of their email authentication policies, which are critical for compliance with GDPR and other data protection regulations in Europe.

Defensive guidance

1. Implement strict IAM controls: Enforce least privilege access for AWS credentials, rotate keys regularly, and monitor for unusual API activity, especially for SES-related actions such as PutAccountDetails. 2. Enable multi-factor authentication (MFA) for all AWS accounts and use AWS CloudTrail and AWS Config to monitor and alert on suspicious activities. 3. Harden email authentication: Deploy and enforce strong DMARC policies with quarantine or reject actions, alongside correctly configured SPF and DKIM records, to prevent domain spoofing. 4. Monitor SES usage patterns: Set up anomaly detection for SES sending volumes, new verified identities, and multi-region API calls to detect sandbox escape attempts. 5. Conduct regular phishing awareness training focused on tax-related and financial scams, tailored to the organization's regional context. 6. Use threat intelligence feeds to block or monitor communications involving the identified malicious domains (docfilessa.com, managed7.com, street7market.net, street7news.org). 7. Implement network-level and endpoint protections to detect and block phishing payloads and credential harvesting attempts. 8. Review and audit cloud service configurations periodically to ensure no excessive permissions or misconfigurations exist that could be exploited.