Legion Malware Upgraded to Target SSH Servers and AWS Credentials

An updated edition of the commodity malware named Legion comes with expanded functions to compromise SSH servers and Amazon Web Companies (AWS) credentials involved with DynamoDB and CloudWatch.

“This new update demonstrates a widening of scope, with new abilities these kinds of the skill to compromise SSH servers and retrieve further AWS-unique credentials from Laravel web purposes,” Cado Labs researcher Matt Muir said in a report shared with The Hacker Information.

“It is apparent that the developer’s focusing on of cloud expert services is advancing with just about every iteration.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Legion, a Python-primarily based hack device, was initial documented previous month by the cloud security business, detailing its means to breach susceptible SMTP servers in buy to harvest qualifications.

It’s also identified to exploit web servers operating information administration methods (CMS), leverage Telegram as a details exfiltration point, and send spam SMS messages to a record of dynamically-produced U.S. cell quantities by producing use of the stolen SMTP credentials.

A noteworthy addition to Legion is its means to exploit SSH servers applying the Paramiko module. It also involves features to retrieve further AWS-precise qualifications similar to DynamoDB, CloudWatch, and AWS Owl from Laravel web apps.

Upcoming WEBINARZero Rely on + Deception: Understand How to Outsmart Attackers!

Learn how Deception can detect advanced threats, cease lateral movement, and increase your Zero Belief technique. Be part of our insightful webinar!

Preserve My Seat!

A further change relates to the inclusion of more paths to enumerate for the existence of .env files these kinds of as /cron/.env, /lib/.env, /sitemaps/.env, /resources/.env, /uploads/.env, and /web/.env amid other people.

“Misconfigurations in web purposes are however the major strategy applied by Legion to retrieve credentials,” Muir mentioned.

“For that reason, it is really proposed that developers and administrators of web applications often review accessibility to sources inside of the apps them selves, and search for alternatives to storing tricks in ecosystem files.”

Located this report exciting? Abide by us on Twitter  and LinkedIn to browse much more distinctive material we submit.