[SentinelOne] Dissecting AlienFox | The Cloud Spammer’s Swiss Army Knife

Executive Summary

• SentinelLabs analyzed several iterations of “AlienFox,” a comprehensive toolset for harvesting credentials for multiple cloud service providers.
• Attackers use AlienFox to harvest API keys & secrets from popular services including AWS SES & Microsoft Office 365.
• AlienFox is a modular toolset primarily distributed on Telegram in the form of source code archives. Some modules are available on GitHub for any would-be attacker to adopt.
• The spread of AlienFox represents an unreported trend towards attacking more minimal cloud services, unsuitable for cryptomining, in order to enable and expand subsequent campaigns.
• Along with our thorough analysis of different AlienFox iterations, we provide a full list of indicators of compromise, YARA rules, and recommendations in the full report.

Dissecting AlienFox | The Cloud Spammer’s Swiss Army Knife

A sophisticated new toolset is being used to harvest credentials from multiple cloud service providers, including AWS SES and Microsoft Office 365.

SentinelOneAlex Delamotte