The Dark Economy of Stolen Cloud Accounts in Phishing Attacks

Explore a conference talk that delves into the underground market of stolen cloud accounts and their role in phishing attacks, presented by cybersecurity experts Alessandro Brucato and Stefano Chierici. Learn about the complex dark economy behind phishing emails, focusing on how compromised Amazon Simple Email Service (SES) accounts are traded and exploited. Discover the detailed investigation of two threat actors - an Indonesian group compromising AWS accounts and a French threat actor launching phishing campaigns targeting French travel card users. Master new detection techniques for monitoring email-related events not logged in CloudTrail, including implementations using Amazon Simple Notification Service, CloudWatch, and Lambda functions. Gain valuable insights into defensive strategies against cloud-native phishing attacks through understanding the complete ecosystem of dark markets and threat actors operating in this space.