Updates to Legion: A Cloud Credential Harvester and SMTP Hijacker
Cado Labs (now part of Darktrace) discovered an updated version of the Legion hacktool. This new iteration has enhanced capabilities, including SSH abuse and exploiting additional AWS services like DynamoDB, CloudWatch, and AWS Owl, by harvesting credentials from misconfigured web servers.