In late October 2025, Fortinet's FortiGuard Labs described TruffleNet, an attack infrastructure built to test stolen Amazon Web Services credentials at scale. In one incident involving multiple compromised credentials, Fortinet recorded activity from more than 800 unique hosts across 57 distinct Class C networks, all running TruffleHog, the open-source secret-scanning tool, and many configured with the Portainer container management interface. These were the attackers' hosts, not victims. Each typically made just two calls with a stolen key: GetCallerIdentity, to check that the key worked, and GetSendQuota, to see how much email it could send through Amazon Simple Email Service (SES). Alongside this activity, Fortinet observed an attacker in a compromised AWS account try and fail to create a new identity, then use an account with SES rights to register sending identities for six hijacked domains, signed with a stolen DKIM key, and send a fake $50,000 vendor invoice to the oil and gas sector. Fortinet said it was unclear whether that SES abuse was directly related to TruffleNet.
Key takeaways
- TruffleNet used more than 800 attacker-controlled hosts across 57 networks to test stolen AWS access keys with TruffleHog.
- The hosts called GetCallerIdentity to validate keys and GetSendQuota to check Amazon SES sending capacity; most had no bad reputation, suggesting dedicated infrastructure.
- In a compromised account, an attacker failed to escalate privileges but used an account with SES rights to create sending identities for hijacked domains.
- One domain was used in a fake vendor invoice requesting a $50,000 payment; Fortinet said the link to TruffleNet was unclear.
- The identity lesson: every long-lived AWS access key is a potential spam and fraud engine, and attackers now check stolen keys automatically within minutes.
At a glance
| Organisations | AWS customers whose access keys were stolen; Fortinet FortiGuard Labs (research) |
|---|---|
| When | Published by Fortinet 31 October 2025 |
| Attacker | Unattributed |
| Entry point | Stolen AWS access keys, validated with GetCallerIdentity from TruffleNet hosts |
| Identities abused | AWS IAM access keys; an account with SES permissions; a stolen DKIM signing key from a WordPress site |
| Impact | Large-scale key validation; in one environment, SES sending identities created and used for a business email compromise attempt |
| Category | NHI. Incident class: confirmed NHI breach (stolen cloud access keys used for reconnaissance and SES abuse) |
What happened
"In recent activity, we identified a campaign in which adversaries used stolen credentials to target SES," Fortinet wrote. It described "a large-scale attack infrastructure" dubbed TruffleNet, "built around the open-source tool TruffleHog, which is used to systematically test compromised credentials and perform reconnaissance across AWS environments." The initial connection "typically consisted of a simple call to GetCallerIdentity, used to test whether credentials were valid," while another component used the AWS CLI to query GetSendQuota, "a call frequently seen at the outset of SES abuse." Fortinet noted that "the vast majority of TruffleNet IPs showed no bad reputation or antivirus detections," which suggested infrastructure built for this purpose, and that no follow-on actions came from these hosts.
In the compromised environment, Fortinet observed more aggressive activity: "the attackers conducted more aggressive cloud reconnaissance, followed by an attempted privilege escalation by creating a new identity. The escalation attempt failed, but one user account possessed sufficient privileges to interact with the SES service." The attacker created six email identities, attaching a DKIM key compromised from a WordPress site so that SES would sign messages as those domains. One domain was then used in a "BEC vendor onboarding W-9 scam" targeting the oil and gas sector, with an invoice purporting to be from ZoomInfo requesting a $50,000 ACH payment. Fortinet was careful about attribution: "it remains unclear whether the additional SES abuse was directly related" to TruffleNet, though it was observed alongside it.
How the AWS keys were first stolen is not stated in Fortinet's report. The Wiz threat catalogue entry for the campaign summarises the same findings.
Timeline
| Date | Event |
|---|---|
| 31 October 2025 | FortiGuard Labs publishes its TruffleNet research. |
| 5 November 2025 | Apono summarises the findings. |
| 13 November 2025 | Wiz's threat catalogue entry for TruffleNet is last updated. |
How it happened: the identity attack path
- Keys stolen. AWS access keys were obtained by means not described.
- Keys validated. TruffleNet hosts called GetCallerIdentity to confirm each key worked.
- Capability checked. GetSendQuota revealed how much email each account could send through SES.
- Escalation attempted. In one account, creating a new identity failed.
- SES abused. An account with SES rights registered hijacked domains and sent fraudulent invoices.
Impact
- Scale: more than 800 attacker hosts validating stolen keys.
- Observed abuse: six SES sending identities created; a fake $50,000 invoice sent to the oil and gas sector.
- Uncertain: whether the BEC activity was directly related to TruffleNet, according to Fortinet.
What this means for NHI governance
A stolen AWS access key is a non-human identity in someone else's hands. TruffleNet shows how industrialised the checking has become: hundreds of hosts, running a legitimate secret-scanning tool, testing keys and sizing up their email capacity automatically. A key that still works and can send email is immediately valuable for fraud, whether or not it can reach anything else.
The defences are familiar but often incomplete: replace long-lived access keys with roles and short-lived credentials, give each key only the services it needs so an unrelated key cannot use SES, and watch for GetCallerIdentity and GetSendQuota calls from unfamiliar sources. See our Cloud Workload Identity Guide and Secrets Management Guide.
Recommendations
- Replace long-lived AWS access keys. Use IAM roles and short-lived credentials. See the Cloud Workload Identity Guide.
- Scope keys to the services they need. Most keys should not be able to use SES or IAM. See the Cloud PAM and CIEM Guide.
- Alert on reconnaissance calls. Watch GetCallerIdentity, GetSendQuota and SES identity changes from unusual sources. See the ITDR Guide.
- Rotate exposed keys immediately. Assume attackers test leaked keys within minutes. See the Leaked Credential Response Playbook.
- Verify vendor payment changes out of band. Authenticated email from a real domain is not proof of identity. See the Email Identity and BEC Guide.
Frequently asked questions
What is TruffleNet?
An attack infrastructure of more than 800 hosts, described by Fortinet, that used the TruffleHog tool to test stolen AWS access keys and check their ability to send email through Amazon SES.
Were 800 hosts compromised?
No. The 800-plus hosts were the attackers' own infrastructure used for testing keys, not victims.
How was Amazon SES abused?
In one compromised account, an attacker created SES sending identities for hijacked domains with a stolen DKIM key and sent a fake vendor invoice. Fortinet said it was unclear whether this was directly related to TruffleNet.
Related NHI Mgmt Group resources
Codefinger S3 Ransomware 2025 · 12,000 Secrets in LLM Training Data · Cloud Workload Identity Guide · Email Identity and BEC Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
Cloud access keys are tested by attackers almost as soon as they leak. We help teams remove long-lived keys, scope what remains and detect the first reconnaissance calls. See our NHI and AI agent security training.
References
- FortiGuard Labs: Cloud Abuse at Scale: TruffleNet, AWS SES, and Business Email Compromise (31 October 2025)
- Apono: TruffleNet Weaponizes Stolen Credentials to Target AWS (5 November 2025)
- Wiz Cloud Threat Landscape: TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud (November 2025)