Legion: AWS Credential Harvester and SMTP Hijacker

According to Darktrace, Legion is a Python-based credential harvester and hacktool surfaced by Cado Security Labs, designed to exploit a range of services for email abuse. The malware targets credentials from misconfigured web servers and even includes functionality to brute-force AWS credentials, create an IAM user named ses_legion with a tag Owner = ms[.]boharas, and attach an AdministratorAccess policy to a new group SESAdminGroup.

It also attempts to query SES quotas and send a test email using the harvested AWS credentials. In addition to email abuse, Legion features an SMS hijacking capability that gathers US mobile numbers via the website randomphonenumbers[.]com and can send SMS messages using retrieved SMTP credentials. The tool includes PHP exploitation components, including a module referencing CVE-2017-9841 to post PHP code for remote code execution and potential webshell deployment.

Researchers note the malware’s broad service targeting—Twilio, Shodan, AWS, and various CMS credentials—highlighting its general-purpose credential harvesting and mass-spamming potential.