Xeon Sender: A Repurposed Crimeware Tool Targeting SaaS Credentials for SMS Spam

Introduction

On August 19, 2024, SentinelOne released a report on the rise and repurposing of Xeon Sender, a Python script initially discovered in 2022, which has since been exploited by various threat actors. This tool, notorious for enabling SMS spam campaigns through multiple SaaS providers, continues to evolve in the hands of cybercriminals. The report highlights the growing threat of SMS spam and smishing attacks, leveraging legitimate APIs from cloud and SaaS services.

Report Overview

Xeon Sender, also known as XeonV5 or SVG Sender, emerged in the cybercrime landscape in 2022. Initially attributed to a hacker under the handle @darkworld47, this cloud attack tool was quickly adopted and modified by other threat actors. Over time, different versions of Xeon Sender appeared, with various actors branding it as their own. Despite these modifications, the core functionality of the tool remains consistent, enabling large-scale SMS spam and smishing campaigns.

Xeon Sender operates by utilizing legitimate APIs from nine different SaaS providers, including Amazon SNS, Twilio, and Nexmo, to send bulk SMS messages. The tool requires valid API keys and other credentials to function, meaning the attackers must have already compromised accounts on these platforms. Once the credentials are obtained, Xeon Sender uses Python libraries like requests or specific provider modules to craft and send SMS messages en masse. The script's main class contains methods that manage interactions with each service provider, handling API requests and the sending of messages to targeted phone numbers.

However, the tool lacks sophistication in certain areas, such as error handling and clarity in API interactions. For instance, while some providers offer status messages or error reports, others simply return a generic "Success" message, regardless of the outcome. This inconsistency presents challenges for defenders attempting to detect and mitigate the abuse of these services.

The consequences of Xeon Sender's activities are significant. Organizations that have gone through the rigorous process of enabling SMS APIs, which are regulated by federal laws, are particularly at risk. The tool’s ability to send bulk messages using legitimate credentials makes it a potent weapon in the hands of cybercriminals, capable of overwhelming recipients with spam or smishing attempts. The broader implications include potential damage to the reputations of the SaaS providers involved, increased regulatory scrutiny, and financial losses for the victims whose credentials have been compromised.

Insights and Analysis

Given the tool’s reliance on legitimate SaaS APIs, detection and prevention are challenging. Security teams must monitor for unusual activities related to SMS permissions, such as unexpected changes to distribution lists or an influx of new recipient phone numbers. For AWS users, specific API calls like GetSMSAttributes or SetSMSAttributesshould be closely watched, as they could indicate the preliminary stages of an attack using Xeon Sender.

To protect against threats like Xeon Sender, organizations should strengthen their monitoring and detection capabilities, particularly around SMS APIs and related permissions. Regularly reviewing and tightening security protocols for API keys and other credentials can also help mitigate the risk of compromise. As the tool continues to evolve, staying informed about its variants and improving detection strategies will be crucial for maintaining robust cybersecurity defenses.

Xeon Sender exemplifies the ongoing trend of cybercriminals exploiting cloud services for SMS spam campaigns. The tool's ability to use legitimate credentials and APIs from well-known SaaS providers poses a significant challenge to defenders. By understanding the tool’s mechanics and potential impact, organizations can take proactive steps to protect themselves from this growing threat.

Indicators of Compromise (IOC)

MITRE ATT&CK Table

References

Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Credentials

Cloud attack tool has been repurposed by multiple threat actors to push SMS spam and smishing campaigns through major SaaS providers.

SentinelOneAlex Delamotte