Cloud Abuse: TruffleNet BEC Campaign Hijacks AWS SES and Portainer to Orchestrate 800+ Malicious Hosts

Fortinet’s FortiGuard Labs has identified a widespread cloud abuse campaign dubbed “TruffleNet” that uses stolen AWS credentials to abuse Amazon SES for large-scale BEC and email fraud, orchestrated from more than 800 unique hosts across 57 distinct networks.

According to Fortinet, the infrastructure shows a centrally managed, purpose-built system with hosts sharing open ports and identical behavioural patterns, including the use of Portainer as a lightweight control panel to coordinate hundreds of compromised nodes. The attackers exploited SES to establish sending identities using DKIM keys stolen from hacked WordPress sites, enabling them to send convincing phishing and spoofed emails that bypass common filters.

Fortinet detailed a sequence of AWS API calls—such as ListIdentities, ListServiceQuotas, UpdateLoginProfile, CreateUser, and PutAccountVdmAttributes—mapped to MITRE techniques including Account Discovery, Cloud Service Discovery, and Create Cloud Account. Fortinet’s analysis notes 800+ active hosts from 10 unique ASNs, with the campaign largely US-based and tied to several domains used in the attacks, suggesting cross-campaign overlap among financially motivated actors.