TruffleNet and Cloud Abuse at Scale: An Identity Architecture Failure

The TruffleNet campaign abused stolen long-lived AWS credentials to validate access, configure AWS SES sending identities (including DKIM), and send authenticated Business Email Compromise at scale. The incident highlights a systemic identity architecture failure—static credentials with broad permissions and no workload binding—enabling attackers to operate inside trusted cloud infrastructure; the report argues for ephemeral, workload-bound identities and identity-first controls to eliminate this attack class.