SYMBOLCOMMON_NAMEaka. SYNONYMS

JavaGhost  (Back to overview)


JavaGhost is a threat actor group that has targeted cloud environments, particularly AWS, for phishing campaigns without engaging in data theft for extortion. They exploit overly permissive IAM permissions and utilize long-term access keys to gain initial access, employing the GetFederationToken API to acquire temporary credentials for console access. JavaGhost has demonstrated advanced evasion techniques, avoiding common detection methods by not using the GetCallerIdentity API call. Their activities generate detectable logging footprints in CloudTrail, allowing organizations to identify and respond to their tactics.


Associated Families

There are currently no families associated with this actor.


References
2025-02-28Palo Alto Networks Unit 42Margaret Kelley
JavaGhost’s Persistent Phishing Attacks From the Cloud
JavaGhost

Credits: MISP Project
Select families...