Wiz Details AWS SES Abuse Campaign Using Compromised Keys to Enable Phishing
Summary
Wiz traced a May 2025 campaign from compromised AWS keys to SES production-mode access and phishing setup. Multi-region API activity and rapid sender configuration provided indicators for detection; the credential theft campaign’s operator remains unattributed.
Key points
- The attacker used compromised AWS access keys to probe SES, then sent bursts of PutAccountDetails requests across AWS regions to seek production access; AWS approved the request.
- The attacker’s attempts to raise sending limits through CreateCase and to escalate IAM privileges failed, leaving the account at the standard production quota.
- The attacker added identities for attacker-owned domains, including managed7[.]com, street7news[.]org, street7market[.]net and docfilessa[.]com, and created common sender addresses.
- Wiz and Proofpoint linked the setup to phishing emails referencing 2024 tax forms and targeting multiple organizations without a clear geographic or industry focus.
- The messages linked to a suspected credential-theft site at irss[.]securesusa[.]com, concealed behind a commercial traffic-analysis redirect; Wiz assessed the campaign was likely financially motivated but did not link it to a known group.
- Wiz identified multi-region PutAccountDetails bursts, API-based CreateCase requests and rapid creation of SES domains and identities as suspicious activity to monitor.
- Recommended defenses include restricting SES where unused, rotating and auditing IAM keys, enforcing least privilege, and monitoring SES API calls and email-sending activity.
Article Details
- Attack Vectors
- The attacker used a compromised AWS access key to access the victim’s environment and call SES APIs.
- The attacker attempted to move the SES account out of sandbox mode by issuing PutAccountDetails requests across AWS regions.
- The attacker verified sender identities on attacker-owned domains and used them to send tax-themed phishing emails.
- The phishing emails linked to a credential-theft site concealed behind a commercial traffic-analysis-service redirect.
- Defensive Notes
- Apply an AWS Service Control Policy to block SES in accounts where it is not needed.
- Rotate IAM keys regularly and monitor for dormant keys that suddenly become active.
- Enforce least privilege for identities that can verify senders or request SES production access.
- Use CloudTrail to monitor SES API calls, including PutAccountDetails, and alert on unusual sender additions or spikes in SendEmail usage; enable SES data events where possible.
- Monitor for multi-regional bursts of PutAccountDetails requests, CreateCase API calls outside the AWS Console, and rapid creation of domains and email identities.
- Investigate unusual login locations, activity from multiple countries in a short timeframe, and sudden increases in cloud-service usage.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | docfilessa[.]com | Attacker-owned domain added as a verified SES sender identity for the phishing campaign. |
| DOMAIN | managed7[.]com | Attacker-owned domain added as a verified SES sender identity for the phishing campaign. |
| DOMAIN | street7market[.]net | Attacker-owned domain added as a verified SES sender identity for the phishing campaign. |
| DOMAIN | street7news[.]org | Attacker-owned domain added as a verified SES sender identity for the phishing campaign. |
| HOSTNAME | irss[.]securesusa[.]com | Host of the credential-theft site linked in the phishing campaign. |
MITRE ATT&CK
T1078.004 · Cloud AccountsThe attacker used a compromised AWS access key and called GetCallerIdentity to identify the associated account.T1098 · Account ManipulationThe attacker submitted PutAccountDetails requests to seek SES production access and attempted to raise sending limits through CreateCase.T1098.003 · Additional Cloud RolesThe attacker attempted to create an IAM policy named ses-support-policy and attach it to the compromised IAM user.T1526 · Cloud Service DiscoveryThe attacker called GetSendQuota and GetAccount to inspect the SES account’s configuration and sandbox status.T1583.001 · DomainsThe article identifies the attacker-owned domains used as verified SES sender identities as infrastructure acquired by the attacker.T1584.001 · DomainsThe article identifies additional legitimate domains with weak DMARC protections as compromised infrastructure used for verified SES sender identities.
Vendors
Amazon Web ServicesThe attacker first compromised an AWS access key - a very common vector. We routinely observe tens of newly compromised cloud access keys each month, fueling hundreds of exploitation attempts.ProofpointWe worked with our colleagues at Proofpoint, who had identified a phishing campaign that was using these domains for the sending email, to gather further insight. WizThe Wiz Research team continuously monitors trends across the threat landscape using Wiz Defend’s threat detection rules. Our goal is to track attacker tradecraft (TTPs) as it evolves, so we can rapidly adapt defenses
Products
Amazon Simple Email Service (SES)Amazon Simple Email Service (SES) is AWS’s cloud-based bulk email platform. By default, accounts operate in a restricted “sandbox” mode, where emails can only be sent to verified addresses and volumes are capped to 200CloudTrailIn AWS, you can surface these anomalies through CloudWatch metrics, billing console, or CloudTrail logs.CloudWatchIn AWS, you can surface these anomalies through CloudWatch metrics, billing console, or CloudTrail logs.Wiz DefendThe Wiz Research team continuously monitors trends across the threat landscape using Wiz Defend’s threat detection rules. Our goal is to track attacker tradecraft (TTPs) as it evolves, so we can rapidly adapt defenses