TruffleNet Breach: 800+ Hosts Compromised via AWS Credentials

Executive Summary

In November 2025, a significant cybersecurity breach known as the “TruffleNet” campaign was uncovered, exposing over 800 hosts across 57 networks. Attackers exploited stolen Amazon Web Services (AWS) credentials to gain unauthorized access to AWS’s Simple Email Service (SES), enabling them to launch Business Email Compromise (BEC) attacks. This sophisticated operation utilized legitimate cloud infrastructure, enhancing the credibility of their phishing attempts. The breach began with the use of TruffleHog, a secret-scanning tool, to validate compromised AWS access keys and culminated in extensive reconnaissance activities. The scale of the attack highlights the urgent need for enhanced security measures to protect cloud-based services and sensitive credentials.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• November 2025: Discovery of the TruffleNet campaign by security researchers.
• Utilization of TruffleHog to scan for and validate AWS credentials.
• Over the following weeks, attackers initiated BEC attacks using hijacked SES accounts.

Data Compromised

• Over 800 hosts were compromised, enabling unauthorized access to AWS services.
• Stolen AWS access keys, which are critical for authentication, were central to the breach.
• Potential exposure of sensitive information due to the hijacking of legitimate email services.

Impact Assessment

• Widespread trust erosion as BEC attacks appeared to originate from legitimate AWS email accounts.
• Organizations using affected AWS services faced increased vulnerability to phishing attacks.
• The breach underscores the importance of monitoring and securing cloud credentials effectively.

Company Response

• AWS has been notified and is actively working to mitigate the impact of the breach.
• Recommendations for affected organizations include immediate credential rotation and enhanced monitoring.
• Security teams are urged to conduct thorough audits of their cloud environments.

Security Implications

• The breach exemplifies the growing trend of attackers using legitimate cloud services for malicious purposes.
• Organizations must implement strict access controls and credential management policies.
• Increased awareness and training on phishing and BEC attack vectors are essential.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.