JavaGhost is a threat actor that exploits AWS IAM permissions for phishing campaigns in cloud environments.
Analyst brief
JavaGhost is a threat actor group targeting AWS cloud environments primarily for phishing campaigns, without engaging in data theft for extortion. They exploit overly permissive IAM permissions and leverage long-term access keys for initial access, using the GetFederationToken API to obtain temporary credentials for console access. Defenders should monitor CloudTrail logs for anomalous GetFederationToken usage, especially in the absence of GetCallerIdentity API calls, and strictly enforce least-privilege IAM policies to mitigate their TTPs.
JavaGhost
unknown
JavaGhost is a threat actor group that has targeted cloud environments, particularly AWS, for phishing campaigns without engaging in data theft for extortion. They exploit overly permissive IAM permissions and utilize long-term access keys to gain initial access, employing the GetFederationToken API to acquire temporary credentials for console access. JavaGhost has demonstrated advanced evasion techniques, avoiding common detection methods by not using the GetCallerIdentity API call. Their activities generate detectable logging footprints in CloudTrail, allowing organizations to identify and respond to their tactics.