Updates to Legion: A Cloud Credential Harvester and SMTP Hijacker

According to Cado Labs (now part of Darktrace), an updated version of Legion, a cloud credential harvester and SMTP hijacker, has been discovered with enhanced capabilities, including SSH abuse and the exploitation of additional AWS services such as DynamoDB, CloudWatch and AWS Owl by harvesting credentials from misconfigured web servers.

The updated Legion searches for environment variable files in misconfigured PHP Laravel apps, extracts credentials from .env files, and targets specific AWS services by parsing for variables like CLOUDWATCH_LOG_KEY and AWSOWL_ACCESS_KEY_ID. It also widens its scope by enumerating new paths to locate .env files, listing dozens of directories such as /lib/.env, /cron/.env and /administrator/.env, among others.

In addition, a subject line update now references “King Forza” in test emails, with the attacker-facing SMTP content including a King Forza SMTP label and related payload formatting. Legion remains focused on SMTP and SMS abuse, but the update demonstrates added capabilities to compromise SSH servers and retrieve AWS-specific credentials from Laravel deployments.