[Intel]: https://www.cadosecurity.com/updates-to-legion-a-cloud-credential-harvester-and-smtp-hijacker/

[timb-machine]

Area

Malware reports

Parent threat

Reconnaissance, Initial Access, Persistence, Privilege Escalation, Defense Evasion

Finding

https://www.cadosecurity.com/updates-to-legion-a-cloud-credential-harvester-and-smtp-hijacker/

Industry reference

attack:T1594:Search Victim-Owned Websites
attack:T1589:Gather Victim Identity Information
attack:T1589.001:Credentials
attack:T1133:External Remote Services
attack:T1078:Valid Accounts

Malware reference

Legion
wltm

Actor reference

No response

Component

Linux

Scenario

Cloud hosted services