Summary:
Researcher has uncovered an emerging hacktool called 'Legion,' which targets misconfigured web servers to collect credentials for the purpose of email abuse. This tool has been actively distributed and promoted through various public groups and channels on the Telegram messaging service. Recently, researchers have encountered an updated version of Legion that includes additional features relevant to cloud security professionals.[/subscribe_to_unlock_form]
Summary:
Researcher has uncovered an emerging hacktool called 'Legion,' which targets misconfigured web servers to collect credentials for the purpose of email abuse. This tool has been actively distributed and promoted through various public groups and channels on the Telegram messaging service. Recently, researchers have encountered an updated version of Legion that includes additional features relevant to cloud security professionals.[emaillocker id="1283"]
In the previously analyzed version of Legion, the developers included code to extract username and password pairs from a list of stolen database credentials. They attempted to use these credentials to log in to hosts via SSH, assuming that the same credentials were reused across services. The code utilized the Paramiko library, which is a Python implementation of the SSHv2 protocol. However, in the original sample, the import of Paramiko was commented-out, rendering the code ineffective. In the latest update of Legion, it seems that this functionality has been enabled.
In the updated version of Legion, the malware focuses on retrieving credentials for specific services and technologies. These include DynamoDB, Amazon CloudWatch, and AWS Owl. For CloudWatch, Legion specifically searches for the environment variable CLOUDWATCH_LOG_KEY, which is documented in public Laravel projects, including a project designed for CloudWatch logging in Laravel. This aligns with Legion's targeting of credentials in Laravel apps. In addition to general refactoring, the developers of Legion have implemented some notable updates to the hacktool. One update involves modifying the subject line of test emails sent by the malware to include a reference to "King Forza." This name was also connected to the operators of Legion through a YouTube channel discovered by Cado researchers. Furthermore, Legion now includes additional paths to search for the presence of .env files, expanding its ability to locate and gather credentials from misconfigured web servers.
Legion is an actively developed hacktool that focuses on harvesting credentials from vulnerable web applications, primarily for SMTP and SMS abuse. The recent update indicates an expansion of capabilities, including compromising SSH servers and retrieving AWS-specific credentials from Laravel web applications. Detection and prevention advice remains consistent, emphasizing the need to address misconfigurations in web applications and avoid storing secrets in environment files. For AWS users, identifying the creation of an IAM user with the "Owner" tag set to "ms.boharas" is a strong indicator of Legion's compromise.
Threat Profile:
References:
The following reports contain further technical details:
https://thehackernews.com/2023/05/legion-malware-upgraded-to-target-ssh.html
https://Eventus Security.com/advisory/legion-an-aws-credential-harvester-and-smtp-hijacker/
[/emaillocker]