Java Ghost’s Persistent Phishing Attacks From the Cloud
Summary: Unit 42 reports high-confidence overlap between a phishing cluster it tracks as TGR-UNK-0011 and JavaGhost, a group active for over five years that moved from website defacement in 2019 to phishing for financial gain in 2022 and was still observed in December 2024. The group gains entry to victims' AWS environments using exposed long-term access keys, then abuses overly permissive IAM permissions on SES and WorkMail to send phishing from the victims' own infrastructure, and has adopted CloudTrail evasion methods previously seen from Scattered Spider.
Bottom line: JavaGhost skips the GetCallerIdentity call defenders alert on and instead opens with GetServiceQuota, GetSendQuota and GetAccount, then mints console access via GetFederationToken and GetSigninToken - and none of the customer AWS environments in Unit 42's engagements had SES data events enabled, so the phishing setup shows up only in CloudTrail management events.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026