Legion is a Python-based credential harvester and hacktool sold via Telegram, designed to abuse various services by extracting credentials and hijacking cloud resources for email and SMS abuse. It exhibits capabilities to perform web server exploitation, credential harvesting from misconfigured CMSs, AWS IAM abuse, and SMS spamming, with links to the AndroxGh0st family. #Legion #AndroxGh0st #AWS #SES #Shodan #TelegramBotAPI #CVE-2017-9841
Keypoints
- Legion is a Python-based credential harvester and hacktool marketed through Telegram, with modules for SMTP enumeration, remote code execution, and CMS/PHP exploitation.
- It targets misconfigured web servers and CMS apps (e.g., Laravel) to extract credentials from files like .env and other secret resources.
- The malware can implant webshells on compromised servers to enable ongoing control and further actions.
- Legion includes capabilities to brute-force CPanel/WHM and AWS accounts, and contains an aws_generator function for AWS credential generation attempts.
- It demonstrates cloud abuse by creating an IAM user, a SESAdminGroup, and attaching AdministratorAccess to enable SES usage and quota checks.
- Communication with operators uses Telegram Bot API to report results and Shodan API to discover targets, showing extensive external-service integration.
- Legion adds an SMS hijacking feature to spam US mobile users, leveraging carrier lists and random phone number generation to target numbers.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The malware uses a PHP unauthenticated RCE vulnerability, tracked as CVE-2017-9841, by posting PHP payloads to a vendor path to gain access. Quote: ‘This is a well-known PHP unauthenticated RCE vulnerability, tracked as CVE-2017-9841.’
- [T1505.003] Web Shell – It includes code to implant webshells on compromised servers for long-term control. Quote: ‘the malware includes code to implant webshells.’
- [T1552.001] Credentials in Files – Legion searches misconfigured servers for credentials in environment/config files (e.g., Laravel .env) and parses them. Quote: ‘The malware maintains a list of likely paths to this file, as well as similar files and directories for other web technologies.’
- [T1046] Network Service Discovery – It interacts with Shodan’s API to retrieve a target list of internet-facing services. Quote: ‘interacting with Shodan’s API to retrieve a target list (providing you supply an API key) and’
- [T1110] Brute Force – The malware brute-forces CPanel/WHM accounts and includes a function dedicated to brute-forcing AWS credentials (aws_generator). Quote: ‘brute-forcing cPanel and WebHost Manager (WHM) accounts’ and ‘a function dedicated to brute-forcing AWS credentials – named aws_generator().’
- [T1136] Create Account – Legion creates an AWS IAM user, an SESAdminGroup, and attaches AdministratorAccess, effectively creating privileged cloud accounts. Quote: ‘IAM user creation and tagging code’ and ‘consisting with the assumption that Legion is primarily concerned with cracking email services, the malware attempts to use the newly-created AWS IAM user to query Amazon SES quota’
- [T1071.001] Web Protocols – It reports results via Telegram Bot API, using web protocols to exfiltrate data to a C2-like channel. Quote: ‘Telegram support is also included, with the ability to pipe the results of each of the modules into a Telegram chat via the Telegram Bot API.’
Indicators of Compromise
- [Filename] Legion samples – legion.py, legion.py (variant) – fcd95a68cd8db0199e2dd7d1ecc4b7626532681b41654519463366e27f54e65a, 42109b61cfe2e1423b6f78c093c3411989838085d7e6a5f319c6e77b3cc462f3
- [User Agent] – Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36, Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
Read more: https://www.cadosecurity.com/legion-an-aws-credential-harvester-and-smtp-hijacker/